CVE-2023-48783

MEDIUM Year: 2023
CVSS v3 Score
5.4
Medium
Weakness Type
CWE-639
View all →

Vulnerability Description

An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.

Related Vulnerabilities

CVE-2019-10108

MEDIUM
CVSS:5.4(Medium)

An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private ...

CWE-6392019

CVE-2019-5966

MEDIUM
CVSS:5.4(Medium)

Joruri Mail 2.1.4 and earlier does not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and alter/disclose the information via unspecified vectors.

CWE-6392019

CVE-2020-5194

MEDIUM
CVSS:5.4(Medium)

The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification oc...

CWE-6392020

CVE-2020-7918

MEDIUM
CVSS:5.4(Medium)

An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.

CWE-6392020

CVE-2021-24473

MEDIUM
CVSS:5.4(Medium)

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pic...

CWE-6392021

CVE-2021-29773

MEDIUM
CVSS:5.4(Medium)

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-F...

CWE-6392021