CVE-2023-2958CWE-639

IDOR in ATS Pro

Critical · published July 17, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

🚨 A tiny oversight in Origin Software ATS Pro lets attackers bypass authentication completely—think of it as having a VIP pass without even being on the list! 🔥 Picture a crowded concert where someone sneaks in a fake backstage pass—nobody checks, and suddenly they’re mingling with the stars. This vulnerability works similarly, allowing unauthorized access to sensitive areas without the proper clearance. An attacker could waltz right in and gain full control over sensitive data and functionalities, leading to absolute chaos. Imagine the devastation of unauthorized users making changes, stealing data, or causing disruptions without anyone knowing!

Put simply

Picture a crowded concert where someone sneaks in a fake backstage pass—nobody checks, and suddenly they’re mingling with the stars. This vulnerability works similarly, allowing unauthorized access to sensitive areas without the proper clearance. This vulnerability enables an authentication bypass due to a user-controlled key, allowing attackers to access the system without proper authorization checks—basically, they can act like they belong when they don’t.

What to do

An attacker could waltz right in and gain full control over sensitive data and functionalities, leading to absolute chaos. Imagine the devastation of unauthorized users making changes, stealing data, or causing disruptions without anyone knowing! Immediately update ATS Pro to version 20230714 or later to close this vulnerability. Regularly review your authentication processes to ensure no similar weaknesses exist. Don't forget to conduct security training for your team to spot potential threats! You've got this! Stay vigilant and proactive, and you'll have this system locked down in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00765 · 55.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-07-17T14:16Z
EPSS history
Timeline
  • 17 JUL 14:16Z
    IDOR in ATS Pro
    cvelistv5