CVE-2020-26175

In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of…

Medium · published December 18, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00667 · 51.3th percentile
Published
2020-12-18T09:27Z
EPSS history
Timeline
  • 18 DEC 09:27Z
    In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of…
    cvelistv5