CVE-2022-22296 Missing authorization in n/a
Attackers can view other users' data by manipulating the id parameter in the manage_user endpoint due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22296?
CVE-2022-22296 is a medium-severity missing authorization vulnerability in n/a, published on 24 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply change the value and data of other users can be displayed.
Weakness: CWE-276
Which versions are affected by CVE-2022-22296?
It affects 1 product.
Products include Hospital\'s Patient Records Management System Project Hospital\'s Patient Records Management System.
How do I fix CVE-2022-22296?
No fix has been published for CVE-2022-22296 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-22296 being exploited?
There is no known exploitation of CVE-2022-22296 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pg55-hv8r-frmh.