CVE-2023-38047

HIGH Year: 2023
CVSS v3 Score
8.1
High
Weakness Type
CWE-639
View all →

Vulnerability Description

A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including admin). This results in unauthorized access and unauthorized data manipulation.

Related Vulnerabilities

CVE-2019-12782

HIGH
CVSS:8.1(High)

An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with write access to at least one pinboard to corrupt pinboards ...

CWE-6392019

CVE-2020-36126

HIGH
CVSS:8.1(High)

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user...

CWE-6392020

CVE-2021-24739

HIGH
CVSS:8.1(High)

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

CWE-6392021

CVE-2021-36801

HIGH
CVSS:8.1(High)

Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.

CWE-6392021

CVE-2021-39225

HIGH
CVSS:8.1(High)

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of an...

CWE-6392021

CVE-2021-46416

HIGH
CVSS:8.1(High)

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.

CWE-6392021