CVE-2023-26580CWE-306CWE-552

Missing Authentication In IDAttend’s IDWeb Application

High · published October 25, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00662 · 51.0th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-552 · Files or Directories Accessible to External Parties
Published
2023-10-25T09:49Z
EPSS history
Timeline
  • 25 OCT 09:49Z
    Missing Authentication In IDAttend’s IDWeb Application
    cvelistv5