CVE-2020-26173

An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid…

Low · published December 18, 2020

CVSS v3.1
3.1
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid document ID and token. No further authentication is required.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00740 · 54.1th percentile
Published
2020-12-18T09:27Z
EPSS history
Timeline
  • 18 DEC 09:27Z
    An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid…
    cvelistv5