Vulnerabilities > CVE-2020-12687 - Exposure of Resource to Wrong Sphere vulnerability in Serpico Project Serpico 1.3.0

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
serpico-project
CWE-668
NVD
Published: 2020-05-07
Updated: 2024-11-21

Summary

An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users (including administrators) from the database.

Vulnerable Configurations

Part Description Count
Application
Serpico_Project
1

Common Weakness Enumeration (CWE)

References