CVE-2023-3374 : Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Pr

Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0.

Published 2023-09-05 17:15:09

Updated 2023-09-08 14:15:21

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2023-3374

Bookreen » Bookreen
Versions before (<) 3.0.0
cpe:2.3:a:bookreen:bookreen:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	Computer Emergency Response Team of the Republic of Turkey
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-184 Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Assigned by: cve@usom.gov.tr (Secondary)

Jump to