CVE-2023-27095 Exposure of Sensitive Information in OpenGoofy Hippo4j
An attacker can escalate privileges by exploiting insecure permissions in the AddUser method of the Tenant Management module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27095?
CVE-2023-27095 is a medium-severity vulnerability in n/a, published on 16 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module.
Weakness: CWE-732
Which versions are affected by CVE-2023-27095?
2 open source packages ship an affected version, including cn.hippo4j:hippo4j-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cn.hippo4j:hippo4j-core Maven | All versions to 1.4.3 | None |
cn.hippo4j:hippo4j-core Maven | All versions to 1.4.3 | None |
Products include Opengoofy Hippo4j.
How do I fix CVE-2023-27095?
No fix has been published for CVE-2023-27095 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-27095 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27095 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xg89-vvwp-9c27.