CVE-2023-25074CWE-285

Competency access levels not enforced in the server

High · published July 24, 2023

CVSS v3.1
7.1
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies.

This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4),

vEL8.60 prior to vEL8.60.2347 (MR6),

vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00314 · 23.1th percentile
Weakness
CWE-285 · Improper Authorization
Published
2023-07-24T23:05Z
EPSS history
Timeline
  • 24 JUL 23:05Z
    Competency access levels not enforced in the server
    cvelistv5