CVE-2023-0944
Summary
| CVE | CVE-2023-0944 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-04-05 20:15:00 UTC |
| Updated | 2023-04-17 16:59:00 UTC |
| Description | Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain actions that can be performed by the user. |
Risk And Classification
Problem Types: CWE-732
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Imaworldhealth | Bhima | 1.27.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bhima 1.27.0 - Account Takeover via IDOR | Advisories | Fluid Attacks | MISC | fluidattacks.com | |
| GitHub - IMA-WorldHealth/bhima: A hospital information management application for rural Congolese hospitals | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.