CVE-2023-24834

medium

Description

WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.

References

https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html

Details

Source: Mitre, NVD

Published: 2023-03-27

Updated: 2023-04-18

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N