CVE-2023-2845 : Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lit

Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.

Published 2023-05-23 05:15:09

Updated 2023-05-30 21:57:10

Source huntr.dev

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-2845

Fit2cloud » Cloudexplorer Lite
Versions before (<) 1.1.0
cpe:2.3:a:fit2cloud:cloudexplorer_lite:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 41 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	2.8	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: security@huntr.dev (Secondary)

https://github.com/cloudexplorer-dev/cloudexplorer-lite/commit/d9f55a44e579d312977b02317b2020de758b763a

Merge pull request #176 from CloudExplorer-Dev/pr@main@fix_huawei_mon… · CloudExplorer-Dev/CloudExplorer-Lite@d9f55a4 · GitHub
Patch

CVEs referencing this url
https://huntr.dev/bounties/ac10e81c-998e-4425-9d74-b985d9b0254c

用户可以将自己添加到任意的组织中 vulnerability found in cloudexplorer-lite
Exploit;Issue Tracking;Patch;Third Party Advisory

Jump to