CVE-2023-25780 Status Internet Co.,Ltd. PowerBPM - Broken Access Control
A LAN attacker with normal user privileges can modify substitute agent settings to arbitrary users due to insufficient authentication in PowerBPM.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25780?
CVE-2023-25780 is a medium-severity missing authorization vulnerability in Status Internet Co.,Ltd. PowerBPM, published on 2 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence.
Weakness: CWE-306
Which versions are affected by CVE-2023-25780?
It affects 1 product.
Products include Status Powerbpm.
How do I fix CVE-2023-25780?
No fix has been published for CVE-2023-25780 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-25780 being exploited?
There is no known exploitation of CVE-2023-25780 in the wild and no public exploit code.
Sources
Also known as GHSA-9c79-wfjr-5h4j.