Description

Webid v1.2.1 suffers from an Insecure Direct Object Reference (IDOR) - Broken Access Control vulnerability, allowing attackers to buy now an auction that is suspended (horizontal privilege escalation).

Remediation

References

CVE-2024-32166

Related Vulnerabilities

WordPress Plugin Link Library 'id' Parameter Cross-Site Scripting and SQL Injection Vulnerabilities (5.0.8)

Apache Tomcat Improper Input Validation Vulnerability (CVE-2013-4286)

WordPress Plugin Video Gallery-Best WordPress YouTube Gallery Multiple Vulnerabilities (1.7.6)

IBM RTC Cross-site Scripting (XSS) Vulnerability (CVE-2020-4697)

WordPress Plugin Akeeba Backup CORE for WordPress Arbitrary File Upload (1.1.3)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-639 CVE-2024-32166