Authorization Bypass

2020-08-0702:30:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

27.7%

JSON

cfme is vulnerable to authorization bypass. The read-only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violates the expected behavior.

CPENameOperatorVersion
cfmeeq5.5.2.4__1.el7cf
cfmeeq5.10.3.3__1.el7cf
cfmeeq5.9.9.1__1.el7cf
cfmeeq5.10.15.1__1.el7cf
cfmeeq5.9.8.1__1.el7cf
cfmeeq5.5.5.4__1.el7cf
cfmeeq5.10.10.0__1.el7cf
cfmeeq5.10.8.0__1.el7cf
cfmeeq5.8.2.3__1.el7cf
cfmeeq5.5.0.13__2.el7cf

Name	Operator	Version
cfme	eq	5.5.2.4__1.el7cf
cfme	eq	5.10.3.3__1.el7cf
cfme	eq	5.9.9.1__1.el7cf
cfme	eq	5.10.15.1__1.el7cf
cfme	eq	5.9.8.1__1.el7cf
cfme	eq	5.5.5.4__1.el7cf
cfme	eq	5.10.10.0__1.el7cf
cfme	eq	5.10.8.0__1.el7cf
cfme	eq	5.8.2.3__1.el7cf
cfme	eq	5.5.0.13__2.el7cf