Vulnerabilities > CVE-2020-26177 - Incorrect Resource Transfer Between Spheres vulnerability in Tangro Business Workflow 1.17.5
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
LOW Availability impact
NONE Summary
In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibited server-side.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |