CVE-2020-35737

Published: Dec 30, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference.

Affected (1)

Products: Newgensoft: Egov

Newgensoft

1 product

Egov

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Newgensoft Egov	Version 12.0

References (6)

http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486

Source: cve@mitre.org

Third Party Advisory

https://www.exploit-db.com/exploits/49378

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.exploit-db.com/exploits/49378

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.