6.5
CVE-2023-24834
- EPSS 0.07%
- Veröffentlicht 27.03.2023 04:15:09
- Zuletzt bearbeitet 21.11.2024 07:48:29
- Quelle twcert@cert.org.tw
- CVE-Watchlists
- Unerledigt
LoginWisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wisdomgarden ≫ Tronclass Ilearn SwEditionweb Version < 1.52.29198
Wisdomgarden ≫ Tronclass Ilearn Version2.3.2 SwPlatformandroid
Wisdomgarden ≫ Tronclass Ilearn Version2.3.2 SwPlatformiphone_os
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.213 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| twcert@cert.org.tw | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.