WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html | Third Party Advisory |
| https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html - Third Party Advisory |
18 Apr 2023, 13:32
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-639 |
01 Apr 2023, 01:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wisdomgarden:tronclass_ilearn:2.3.2:*:*:*:*:iphone_os:*:* cpe:2.3:a:wisdomgarden:tronclass_ilearn:2.3.2:*:*:*:*:android:*:* cpe:2.3:a:wisdomgarden:tronclass_ilearn:*:*:*:*:web:*:*:* |
|
| CWE | CWE-434 | |
| References | (CONFIRM) https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html - Third Party Advisory |
27 Mar 2023, 12:40
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-27 04:15
Updated : 2024-11-21 07:48
NVD link : CVE-2023-24834
Mitre link : CVE-2023-24834
CVE.ORG link : CVE-2023-24834
JSON object : View
Products Affected
wisdomgarden
- tronclass_ilearn
CWE
CWE-639
Authorization Bypass Through User-Controlled Key