CVE-2023-2544

medium

Description

Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-upv-peix

Details

Source: Mitre, NVD

Published: 2023-10-03

Updated: 2023-10-05

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N