CVE-2021-37214
09.08.2021, 10:15
The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command.Enginsight
| Vendor | Product | Version |
|---|---|---|
| larvata | flygo | 𝑥 < 1.91.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-706 - Use of Incorrectly-Resolved Name or ReferenceThe software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.