CVE-2023-27107

HIGH 8.8EPSS 0.8%

Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 allows users who do not have appropriate access rights to generate internal reports using a direct URL.

CVSS v3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.84% chance of exploitation in the next 30 days, 55th percentile
Published: 2023-04-26
Updated: 2025-02-03

Proof-of-concept exploits (1)

https://gist.github.com/smidtbx10/f8ff1c4977b7f54886c6a52e9ef4e816

References

Related