CVE-2024-47657CWE-639

Improper Access Control Vulnerability

High · published October 4, 2024

CVSS v4.0
7.1
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive information belonging to other users.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-10-04T12:30Z
EPSS history
Timeline
  • 04 OCT 12:30Z
    Improper Access Control Vulnerability
    cvelistv5