CVE-2023-43900
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Insecure Direct Object References (IDOR) in eMudhra emSigner v2.8.7 allow authenticated attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters.
Risk Assessment
Risk of confidentiality breach of other users' data, potentially leading to exposure of sensitive information.
Recommendation
Update emSigner to a version that fixes the IDOR issue or implement proper authorization mechanisms.
Other vulnerabilities in eMudhra emSigner
See all- CVE-2023-43902Critical
Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including administrators, via a crafted password reset token.
- CVE-2023-43901High
Incorrect access control in the AdHoc User creation form of eMudhra emSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privileges by using the email address of a registered user.
Original NVD description (English source)
Insecure Direct Object References (IDOR) in eMudhra emSigner v2.8.7 allow authenticated attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters.