Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2023-0998

Summary
Assigner-VulDB
Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5
Published At-24 Feb, 2023 | 07:32
Updated At-02 Aug, 2024 | 05:32
Rejected At-
Credits

SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control

A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221733 was assigned to this vulnerability.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:VulDB
Assigner Org ID:1af790b2-7ee1-4545-860a-a788eba489b5
Published At:24 Feb, 2023 | 07:32
Updated At:02 Aug, 2024 | 05:32
Rejected At:
▼CVE Numbering Authority (CNA)
SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control

A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221733 was assigned to this vulnerability.

Affected Products
Vendor
SourceCodesterSourceCodester
Product
Alphaware Simple E-Commerce System
Modules
  • Payment Handler
Versions
Affected
  • 1.0
Problem Types
TypeCWE IDDescription
CWECWE-284CWE-284 Improper Access Controls
Type: CWE
CWE ID: CWE-284
Description: CWE-284 Improper Access Controls
Metrics
VersionBase scoreBase severityVector
3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
3.06.5MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
2.06.4N/A
AV:N/AC:L/Au:N/C:N/I:P/A:P
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Version: 3.0
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Version: 2.0
Base score: 6.4
Base severity: N/A
Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:P
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
analyst
Murasaki (VulDB User)
Timeline
EventDate
Advisory disclosed2023-02-24 00:00:00
CVE reserved2023-02-24 00:00:00
VulDB entry created2023-02-24 01:00:00
VulDB entry last update2023-03-24 19:00:01
Event: Advisory disclosed
Date: 2023-02-24 00:00:00
Event: CVE reserved
Date: 2023-02-24 00:00:00
Event: VulDB entry created
Date: 2023-02-24 01:00:00
Event: VulDB entry last update
Date: 2023-03-24 19:00:01
Replaced By
Rejected Reason
References
HyperlinkResource
https://vuldb.com/?id.221733
vdb-entry
technical-description
https://vuldb.com/?ctiid.221733
signature
permissions-required
https://github.com/1MurasaKi/PaymentVul_report/blob/main/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/payment_vulnerability.md
exploit
Hyperlink: https://vuldb.com/?id.221733
Resource:
vdb-entry
technical-description
Hyperlink: https://vuldb.com/?ctiid.221733
Resource:
signature
permissions-required
Hyperlink: https://github.com/1MurasaKi/PaymentVul_report/blob/main/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/payment_vulnerability.md
Resource:
exploit
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://vuldb.com/?id.221733
vdb-entry
technical-description
x_transferred
https://vuldb.com/?ctiid.221733
signature
permissions-required
x_transferred
https://github.com/1MurasaKi/PaymentVul_report/blob/main/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/payment_vulnerability.md
exploit
x_transferred
Hyperlink: https://vuldb.com/?id.221733
Resource:
vdb-entry
technical-description
x_transferred
Hyperlink: https://vuldb.com/?ctiid.221733
Resource:
signature
permissions-required
x_transferred
Hyperlink: https://github.com/1MurasaKi/PaymentVul_report/blob/main/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/payment_vulnerability.md
Resource:
exploit
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cna@vuldb.com
Published At:24 Feb, 2023 | 08:15
Updated At:17 May, 2024 | 02:17

A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221733 was assigned to this vulnerability.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.15.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Secondary3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Secondary2.06.4MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:P
Type: Primary
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Type: Secondary
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Type: Secondary
Version: 2.0
Base score: 6.4
Base severity: MEDIUM
Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:P
CPE Matches
alphaware_simple_e-commerce_system_project
alphaware_simple_e-commerce_system_project
>>alphaware_simple_e-commerce_system>>1.0
cpe:2.3:a:alphaware_simple_e-commerce_system_project:alphaware_simple_e-commerce_system:1.0:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-284Primarycna@vuldb.com
CWE ID: CWE-284
Type: Primary
Source: cna@vuldb.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/1MurasaKi/PaymentVul_report/blob/main/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/payment_vulnerability.mdcna@vuldb.com
Exploit
Third Party Advisory
https://vuldb.com/?ctiid.221733cna@vuldb.com
Permissions Required
Third Party Advisory
VDB Entry
https://vuldb.com/?id.221733cna@vuldb.com
Permissions Required
Third Party Advisory
VDB Entry
Hyperlink: https://github.com/1MurasaKi/PaymentVul_report/blob/main/razormist/Alphaware%20-%20Simple%20E-Commerce%20System/payment_vulnerability.md
Source: cna@vuldb.com
Resource:
Exploit
Third Party Advisory
Hyperlink: https://vuldb.com/?ctiid.221733
Source: cna@vuldb.com
Resource:
Permissions Required
Third Party Advisory
VDB Entry
Hyperlink: https://vuldb.com/?id.221733
Source: cna@vuldb.com
Resource:
Permissions Required
Third Party Advisory
VDB Entry

Change History

0
Information is not available yet

Similar CVEs

161Records found
CVE-2024-24568
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.06% / 17.63%
||
7 Day CHG~0.00%
Published-26 Feb, 2024 | 15:54
Updated-13 Feb, 2025 | 17:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Suricata http2: header handling evasion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3.

Action-Not Available
Vendor-oisfOISFoisfFedora Project
Product-fedorasuricatasuricatafedorasuricata
CWE ID-CWE-284
Improper Access Control
CVE-2021-25448
Matching Score-4
Assigner-Samsung Mobile
ShareView Details
Matching Score-4
Assigner-Samsung Mobile
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 46.09%
||
7 Day CHG~0.00%
Published-05 Aug, 2021 | 19:44
Updated-03 Aug, 2024 | 20:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview.

Action-Not Available
Vendor-SamsungSamsung Electronics
Product-smart_touch_callSmart Touch Call
CWE ID-CWE-284
Improper Access Control
CVE-2022-3286
Matching Score-4
Assigner-GitLab Inc.
ShareView Details
Matching Score-4
Assigner-GitLab Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.04% / 10.75%
||
7 Day CHG~0.00%
Published-17 Oct, 2022 | 00:00
Updated-13 May, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member to bypass IP restrictions when using a deploy token

Action-Not Available
Vendor-GitLab Inc.
Product-gitlabGitLab
CWE ID-CWE-284
Improper Access Control
CVE-2021-26732
Matching Score-4
Assigner-Nozomi Networks Inc.
ShareView Details
Matching Score-4
Assigner-Nozomi Networks Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 11.17%
||
7 Day CHG~0.00%
Published-24 Oct, 2022 | 00:00
Updated-07 May, 2025 | 15:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
spx_restservice First_network_func Broken Access Control

A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.

Action-Not Available
Vendor-lannerincLanner Inc
Product-iac-ast2500a_firmwareiac-ast2500aIAC-AST2500A
CWE ID-CWE-284
Improper Access Control
CVE-2024-13102
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-6.9||MEDIUM
EPSS-0.07% / 21.73%
||
7 Day CHG~0.00%
Published-02 Jan, 2025 | 09:31
Updated-02 May, 2025 | 17:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DIR-816 A2 DDNS Service access control

A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Action-Not Available
Vendor-D-Link Corporation
Product-dir-816dir-816_firmwareDIR-816 A2
CWE ID-CWE-266
Incorrect Privilege Assignment
CWE ID-CWE-284
Improper Access Control
CVE-2022-35621
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.3||MEDIUM
EPSS-0.50% / 64.98%
||
7 Day CHG~0.00%
Published-21 Sep, 2022 | 18:14
Updated-28 May, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows remote attackers to execute fraudulent NFT transfers.

Action-Not Available
Vendor-evohclaimable_projectn/a
Product-evohclaimablen/a
CWE ID-CWE-284
Improper Access Control
CVE-2022-33931
Matching Score-4
Assigner-Dell
ShareView Details
Matching Score-4
Assigner-Dell
CVSS Score-6.3||MEDIUM
EPSS-0.24% / 46.84%
||
7 Day CHG~0.00%
Published-10 Aug, 2022 | 16:31
Updated-16 Sep, 2024 | 22:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An attacker with no access to Alert Classification page could potentially exploit this vulnerability, leading to the change the alert categories.

Action-Not Available
Vendor-Dell Inc.
Product-wyse_management_suiteWyse Management Suite
CWE ID-CWE-284
Improper Access Control
CVE-2022-30564
Matching Score-4
Assigner-Dahua Technologies
ShareView Details
Matching Score-4
Assigner-Dahua Technologies
CVSS Score-5.3||MEDIUM
EPSS-0.08% / 23.90%
||
7 Day CHG~0.00%
Published-09 Feb, 2023 | 00:00
Updated-25 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable interface, an attacker can modify the device system time.

Action-Not Available
Vendor-n/aDahua Technology Co., Ltd
Product-sd5a225gb-hnr-sl_firmwarexvr5832s-i2_firmwarexvr5832s-i2xvr5108h-i2_firmwaresd5a232gb-hnrsd59230i-hc\(-s3\)_firmwarenvr4416-16p-4ks2\/i_firmwarexvr5104h-i2sd59225i-hc\(-s3\)nvr4432-4ks2\/i_firmwarenvr5832-i\/l_firmwareipc-hf5442f-ze_firmwarenvr4432-isd5a445xa-hnr-1t_firmwaresd22404t-gn-w_firmwareipc-hf7442f-z-xxvr5216an-xnvr4816-16p-4ks2\/i_firmwareipc-hf5241f-zesd59430i-hcxvr5232an-xipc-hf5541f-ze_firmwarexvr5232an-i2_firmwarenvr5832-i\/lipc-hf5541f-zenvr4816-4ks2\/isd59232xa-hnr_firmwaresd5a225xa-hnr-slsd5a445xa-hnrnvr2104hs-i_firmwaresd5a225gb-hnr_firmwaresd5a425ga-hnr_firmwarenvr5432-16p-i\/lxvr4104hs-x_firmwarexvr5216an-i2sd59230i-hc\(-s3\)xvr5432l-i2_firmwaresd5a825-hnr-ya_firmwarexvr5108h-i2nvr5216-16p-i\/l_firmwaresd59430i-hc_firmwarexvr4108hs-x_firmwaresd5a432gb-hnrnvr4832-isd22404t-gn_firmwarexvr5116h-i2_firmwarexvr5116hs-i2_firmwarexvr5108hs-i2nvr2104-i_firmwaresd5a232xb-hnr-acnvr4816-4ks2\/i_firmwaresd5a232xb-hnr_firmwareipc-hf5842f-zenvr2204-ixvr5104hs-i2ipc-hf7842f-z-x_firmwarenvr2116-i_firmwarexvr5232an-i2sd59232-hc-la_firmwaresd22404t-gn-wxvr5116h-i2sd22204t-gn-s2sd59131i-hc\(-s3\)nvr2208-i_firmwarexvr4104c-x_firmwaresd5a245gb-hnrnvr2208-isd5a245xa-hnrnvr2104hs-invr4416-4ks2\/invr5832\/5864-i_firmwaresd5a225gb-hnr-slxvr5432l-i2nvr2116-ixvr5216a-i2_firmwarexvr5216a-i2xvr5108he-i2xvr5216an-x_firmwarenvr4416-16p-4ks2\/isd5a232xb-hnripc-hf5241f-ze_firmwaresd22204ue-gnnvr2108-isd5a425xa-hnr_firmwareipc-hf5442f-zesd5a225gb-hnrnvr4832-4ks2\/isd59225i-hc\(-s3\)_firmwarexvr5104h-i2_firmwarenvr5216-8p-i\/lxvr5432l-xsd5a245gb-hnr_firmwaresd22204db-gnynvr5216-16p-i\/lsd22204ue-gn_firmwaresd59225u-hni_firmwarenvr2204-i_firmwareipc-hf7442f-z-x_firmwarexvr5104he-i2xvr5108he-i2_firmwarenvr2116hs-i_firmwarenvr4432-i_firmwarenvr5864-i\/l_firmwaresd5a425xa-hnrsd5a232gb-hnr_firmwaresd5a432gb-hnr_firmwarenvr4432-4ks2\/ixvr4108hs-xsd5a245xa-hnr_firmwarexvr5416l-i2nvr2104-invr4432-16p-4ks2\/i_firmwaresd5a225xa-hnr-sl_firmwaresd5a232xb-hnr-pnvr2216-ixvr5116he-i2sd22204-gc-lbxvr5104hs-i2_firmwarexvr5232an-x_firmwaresd59432xa-hnrnvr4832-4ks2\/i_firmwareipc-hf71242f-z-x_firmwareipc-hf5842f-ze_firmwaresd5a445gb-hnrxvr5108hs-i2_firmwarexvr5116hs-i2nvr4832-i_firmwaresd59232-hc-lanvr5216-8p-i\/l_firmwarexvr5808s-i2_firmwarexvr4116hs-xsd22204db-gny_firmwaresd22204ue-gn-wsd59225-hc-la_firmwarexvr5216an-i2_firmwarexvr5408l-i2nvr2116hs-isd5a225xa-hnrxvr5108c-x_firmwaresd5a225xa-hnr_firmwarexvr4116hs-x_firmwaresd5a445xa-hnr-1tnvr4816-16p-4ks2\/ixvr5104he-i2_firmwarexvr4104c-xxvr5808s-i2xvr5816s-i2_firmwaresd22204ue-gn-w_firmwarexvr5408l-i2_firmwarexvr5216a-x_firmwaresd22204-gc-lb_firmwaresd59432xa-hnr_firmwarenvr4416-4ks2\/i_firmwarenvr5832\/5864-isd5a232xb-hnr-p_firmwaresd5a445gb-hnr_firmwarexvr4108c-xsd22204db-gny-w_firmwarenvr2216-i_firmwarenvr4832-16p-4ks2\/i_firmwaresd5a825-hnr-yanvr2108-i_firmwarenvr2108hs-i_firmwaresd59131i-hc\(-s3\)_firmwarenvr4216-isd22204db-gny-wsd5a425ga-hnrnvr4216-i_firmwarexvr5108c-xnvr4832-16p-4ks2\/isd22404t-gnipc-hf71242f-z-xsd59232xa-hnrnvr5864-i\/lxvr5116he-i2_firmwaresd5a825ga-hnrxvr4104hs-xsd5a825ga-hnr_firmwarexvr5216a-xxvr5416l-i2_firmwareipc-hf7842f-z-xnvr5432-16p-i\/l_firmwaresd59225-hc-laxvr5832s-x_firmwarexvr4108c-x_firmwarexvr5432l-x_firmwaresd22204t-gn-s2_firmwarexvr5816s-i2sd59225u-hnisd5a232xb-hnr-ac_firmwaresd5a445xa-hnr_firmwarexvr5832s-xnvr2108hs-invr4432-16p-4ks2\/iIPC-HX5XXX,IPC-HX7XXX,SD5A,SD22,SD59,NVR5XXX-I,NVR5XXX-I/L,NVR4XXX-I,NVR2XXX-I,XVRXXXX-I2,XVRXXXX-X
CWE ID-CWE-284
Improper Access Control
CVE-2024-50353
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.13% / 33.34%
||
7 Day CHG+0.02%
Published-30 Oct, 2024 | 13:57
Updated-13 Nov, 2024 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected

ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not implemented SAS Uri's are unaffected. This issue was resolved in version 8.0.0 of the library.

Action-Not Available
Vendor-iowacomputergurusIowaComputerGurusiowa_computer_gurus
Product-aspnetcore.utilities.cloudstorageaspnetcore.utilities.cloudstorageaspnetcore.utilites.cloudstorage
CWE ID-CWE-284
Improper Access Control
CVE-2024-45124
Matching Score-4
Assigner-Adobe Systems Incorporated
ShareView Details
Matching Score-4
Assigner-Adobe Systems Incorporated
CVSS Score-5.3||MEDIUM
EPSS-0.19% / 41.33%
||
7 Day CHG~0.00%
Published-10 Oct, 2024 | 09:58
Updated-11 Oct, 2024 | 22:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity. Exploitation of this issue does not require user interaction.

Action-Not Available
Vendor-Adobe Inc.
Product-magentocommercecommerce_b2bAdobe Commerceadobe_commerce
CWE ID-CWE-284
Improper Access Control
CVE-2020-3364
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.53% / 66.19%
||
7 Day CHG~0.00%
Published-18 Jun, 2020 | 02:17
Updated-15 Nov, 2024 | 17:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability

A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XR Software, which prevents the ACL from working when applied against the standby route processor management interface. An attacker could exploit this vulnerability by attempting to access the device through the standby route processor management interface.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-ios_xrCisco IOS XR Software
CWE ID-CWE-284
Improper Access Control
CWE ID-CWE-863
Incorrect Authorization
  • Previous
  • 1
  • 2
  • 3
  • 4
  • Next
Details not found