CVE-2023-0959

Published: Apr 5, 2023Modified: Feb 13, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF.

Affected (1)

Products: Imaworldhealth: Bhima

Imaworldhealth

1 product

Bhima

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Imaworldhealth Bhima	Version 1.27.0

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (4)

https://fluidattacks.com/advisories/calamaro/

Source: help@fluidattacks.com

ExploitThird Party Advisory

https://github.com/IMA-WorldHealth/bhima/

Source: help@fluidattacks.com

Product

https://fluidattacks.com/advisories/calamaro/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/IMA-WorldHealth/bhima/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.