| |
Vulnerability CVE-2011-3645
Published: 2011-09-27 Modified: 2012-02-13
| Description: |
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects the settings page of an arbitrary user. |
See advisories in our WLB2 database: | Topic | Author | Date |
Med. |
| Sohil Garg | 27.09.2011 |
Type:
CWE-264 (Permissions, Privileges, and Access Controls)
CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)
| CVSS Base Score |
Impact Subscore |
Exploitability Subscore |
7.5/10 |
6.4/10 |
10/10 |
| Exploit range |
Attack complexity |
Authentication |
Remote |
Low |
No required |
| Confidentiality impact |
Integrity impact |
Availability impact |
Partial |
Partial |
Partial |
References: |
http://www.exploit-db.com/exploits/17897
http://seclists.org/fulldisclosure/2011/Sep/283
|
|
|
Copyright 2024, cxsecurity.com
|
|
|
