CVE-2022-30760
An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID parameter in…
Does this matter?
Lower severity and a low EPSS score (0.95%). Track it; it rarely justifies an emergency change on its own.
Description
An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID parameter in the HTTP POST request to the FrontControllerSS endpoint.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.95% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Affected
- ihb-eg/fn2web
- Source
- cve@mitre.org
References
- https://homepage.ruhr-uni-bochum.de/Christian.Krug-q97/CVE-2022-30760.htmlExploit, Third Party Advisory
- https://wiki.ihb-eg.de/doku.php/releasenotes/fn2web2.04.09Release Notes, Vendor Advisory
- https://homepage.ruhr-uni-bochum.de/Christian.Krug-q97/CVE-2022-30760.htmlExploit, Third Party Advisory
- https://wiki.ihb-eg.de/doku.php/releasenotes/fn2web2.04.09Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.