Vulnerabilities > CVE-2018-16971 - Authorization Bypass Through User-Controlled Key vulnerability in Wisetail Learning Management System

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
LOW
Integrity impact
NONE
Availability impact
NONE
network
low complexity
wisetail
CWE-639
NVD
Published: 2018-09-12
Updated: 2020-08-24

Summary

Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-purchased course contents (quiz / test) via a modified id parameter.

Vulnerable Configurations

Part Description Count
Application
Wisetail
6

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/149356/wle4116-disclose.txt
idPACKETSTORM:149356
last seen2018-09-14
published2018-09-13
reporterS. M. Zia Ur Rashid
sourcehttps://packetstormsecurity.com/files/149356/Wisetail-Learning-Ecosystem-4.11.6-Insecure-Direct-Object-Reference.html
titleWisetail Learning Ecosystem 4.11.6 Insecure Direct Object Reference

References