CVE-2020-26176

An issue was discovered in tangro Business Workflow before 1.18.1

Medium · published December 18, 2020

CVSS v3.1
4.3
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, including their respective IDs. This allows the attacker to gather valid attachment IDs for workitems that do not belong to them.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00754 · 54.6th percentile
Published
2020-12-18T09:26Z
EPSS history
Timeline
  • 18 DEC 09:26Z
    An issue was discovered in tangro Business Workflow before 1.18.1
    cvelistv5