CVE-2021-37215
EUVD-2021-2378909.08.2021, 10:15
The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attacker can manipulate the user data and then over-write another employee’s user data by specifying that employee’s ID in the API parameter.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| larvata | flygo | 𝑥 < 1.91.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-706 - Use of Incorrectly-Resolved Name or ReferenceThe software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.