GHSA-896v-ph5w-379h

Source

https://github.com/advisories/GHSA-896v-ph5w-379h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-896v-ph5w-379h/GHSA-896v-ph5w-379h.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-896v-ph5w-379h

Aliases

CVE-2023-38872

Published

2023-09-28T06:30:20Z

Modified

2023-11-07T05:30:12.119926Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Economizzer Insecure Direct Object Reference vulnerability

Details

An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

Database specific

{
    "severity": "LOW",
    "nvd_published_at": "2023-09-28T04:15:12Z",
    "github_reviewed_at": "2023-09-28T16:49:40Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-639"
    ]
}

References

Affected packages

Packagist / gugoan/economizzer

Package

Name: gugoan/economizzer
Purl: pkg:composer/gugoan/economizzer

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.9-beta1

Affected versions

v0.*

v0.4-alpha

v0.8-alpha

v0.9-beta1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-896v-ph5w-379h/GHSA-896v-ph5w-379h.json"