CVE-2023-0959 - Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator

Back Back to CVE browser

MEDIUM

Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator

Published Apr 5, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.75%

Description

Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF.

Affected products

Vendor n/a Product Bhima Default
n/a
- Version
  1.27.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Bhima

n/a

Version	Status	Constraints
1.27.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12944
Advisory
https://fluidattacks.com/advisories/calamaro/
ExploitThird Party Advisory
https://github.com/IMA-WorldHealth/bhima/
Product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12944		Advisory
https://fluidattacks.com/advisories/calamaro/		ExploitThird Party Advisory
https://github.com/IMA-WorldHealth/bhima/		Product