IDOR: User reads and modifies findings from other people's projects
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Cervantes, a web application for managing security testing projects and findings, is affected by an insecure direct object reference flaw. An authenticated user could exploit this to view, modify, or transfer findings, including sensitive details and client information, from projects they do not belong to.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- CervantesSec cervantes
From alpha 0.3 · through 1.3-beta