Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference (IDOR) attack.
References
Link | Resource |
---|---|
https://cupc4k3.lol/cve-2023-24625-idor-in-faveo-service-desk-37a63f53d896 | Exploit Third Party Advisory |
https://medium.com/%40cupc4k3/vulnerabilities-in-faveo-service-desk-37a63f53d896 | |
https://www.faveohelpdesk.com/servicedesk/ | Product |
Configurations
History
29 Mar 2023, 13:21
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-639 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
CPE | cpe:2.3:a:ladybirdweb:faveo_servicedesk:5.0.1:*:*:*:*:*:*:* | |
References | (MISC) https://cupc4k3.lol/cve-2023-24625-idor-in-faveo-service-desk-37a63f53d896 - Exploit, Third Party Advisory | |
References | (MISC) https://medium.com/@cupc4k3/vulnerabilities-in-faveo-service-desk-37a63f53d896 - Exploit, Third Party Advisory | |
References | (MISC) https://www.faveohelpdesk.com/servicedesk/ - Product |
24 Mar 2023, 17:57
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-03-24 15:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-24625
Mitre link : CVE-2023-24625
CVE.ORG link : CVE-2023-24625
JSON object : View
Products Affected
ladybirdweb
- faveo_servicedesk
CWE
CWE-639
Authorization Bypass Through User-Controlled Key