CVE-2023-38872

An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

CVSS v3.1 NVD

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.75% chance of exploitation in the next 30 days, 54th percentile

Published

2023-09-28

Updated

2024-09-23

Proof-of-concept exploits (1)

• dub-flow/vulnerability-research/tree/main/CVE-2023-3887251★ · 2024-03-10

Security advisories

• advisories/GHSA-896v-ph5w-379h
• gugoan/economizzer
• https://www.economizzer.org

References

• CVE Record
• NVD entry

Related

• CVE-2023-38870
• CVE-2023-38874
• CVE-2023-38877
• CVE-2023-40618