A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231801 was assigned to this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/sleepyvv/vul_report/blob/main/C-data/BrokenAccessControl.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.231801 | Third Party Advisory |
| https://vuldb.com/?id.231801 | Third Party Advisory |
Configurations
History
30 Jun 2023, 07:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:cdatatec:web_management_system:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://github.com/sleepyvv/vul_report/blob/main/C-data/BrokenAccessControl.md - Exploit, Third Party Advisory | |
| References | (MISC) https://vuldb.com/?id.231801 - Third Party Advisory | |
| References | (MISC) https://vuldb.com/?ctiid.231801 - Third Party Advisory | |
| First Time |
Cdatatec web Management System
Cdatatec |
18 Jun 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-18 08:15
Updated : 2024-04-11 01:21
NVD link : CVE-2023-3305
Mitre link : CVE-2023-3305
CVE.ORG link : CVE-2023-3305
JSON object : View
Products Affected
cdatatec
- web_management_system
CWE
CWE-284
Improper Access Control