VulnerabilityModified

CVE-2023-0967

Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator.

MEDIUM 6.5EPSS 0.67%

Does this matter?

Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own.

Description

Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator. This is possible because the application is vulnerable to IDOR, it does not properly validate user permissions with respect to certain actions the user can perform.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.67% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: imaworldhealth/bhima
Source: help@fluidattacks.com

References

https://fluidattacks.com/advisories/ingrosso/Exploit
https://github.com/IMA-WorldHealth/bhima/Product
https://fluidattacks.com/advisories/ingrosso/Exploit
https://github.com/IMA-WorldHealth/bhima/Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.