Vulnerabilities > CVE-2020-9384 - Authorization Bypass Through User-Controlled Key vulnerability in Subex ROC Partner Settlement 10.5

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
subex
CWE-639
NVD
Published: 2020-04-14
Updated: 2024-04-11

Summary

An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the application

Vulnerable Configurations

Part Description Count
Application
Subex
1

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/157197/Subex_ROC_Partner_Settlement_10.5_IDOR.txt
idPACKETSTORM:157197
last seen2020-04-20
published2020-04-12
reporterJirawat Vuthawiphat
sourcehttps://packetstormsecurity.com/files/157197/Subex-ROC-Partner-Settlement-10.5-Insecure-Direct-Object-Reference.html
titleSubex ROC Partner Settlement 10.5 Insecure Direct Object Reference

References