CVE-2024-25270

Published Sep 12, 2024

Last updated 5 months ago

CVSS medium 4.3

Overview

Description: An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-639

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mirapolis:lms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8E335055-E4D8-4AE4-8F41-F0F4A2D0D700",
            "versionStartIncluding": "4.6.00"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References