CVE-2023-31435 Missing authorization in n/a
Authenticated attackers can read and write unauthorized data in evasys by directly accessing specific functions without proper authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31435?
CVE-2023-31435 is a high-severity missing authorization vulnerability in n/a, published on 2 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allow authenticated attackers to read and write to unauthorized data by accessing functions directly.
Weakness: CWE-863
Which versions are affected by CVE-2023-31435?
It affects 1 product.
Products include Evasys Evasys.
How do I fix CVE-2023-31435?
No fix has been published for CVE-2023-31435 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-31435 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31435 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-q3w6-ggw8-49fj.