CVE-2023-1541 : Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.

Published 2023-03-21 05:15:10

Updated 2023-03-27 15:21:04

Source huntr.dev

View at NVD, CVE.org

Products affected by CVE-2023-1541

Answer » Answer
Versions before (<) 1.0.6
cpe:2.3:a:answer:answer:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.0	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H	1.2	4.7	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: High
3.8	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L	1.2	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: Low

https://huntr.dev/bounties/8fd891c6-b04e-4dac-818f-9ea30861cd92

Admin Able To Perform Operations On Themselves By Interacting With API vulnerability found in answer
Exploit;Third Party Advisory
https://github.com/answerdev/answer/commit/15390adbfcd5fd37af4661f992f8873ae5a6b840

fix(admin): add restriction about admin modify their password · answerdev/answer@15390ad · GitHub
Patch

Jump to