5.7
CVE-2023-3227
- EPSS 0.41%
- Veröffentlicht 14.06.2023 06:15:08
- Zuletzt bearbeitet 21.11.2024 08:16:44
- Quelle security@huntr.dev
- CVE-Watchlists
- Unerledigt
LoginInsufficient Granularity of Access Control in fossbilling/fossbilling
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fossbilling ≫ Fossbilling Version < 0.5.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.41% | 0.322 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.7 | 2.1 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
|
| security@huntr.dev | 5.4 | 2.8 | 2.5 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
|
CWE-1220 Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
https://github.com/fossbilling/fossbilling/commit/b65a75fcf70feaf547d414672f78d7cbe8a98e7e
https://huntr.dev/bounties/97ecf4b8-7eeb-4e39-917c-2660262ff9ba