CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16971 – Wisetail Learning Ecosystem 4.11.6 Insecure Direct Object Reference
https://notcve.org/view.php?id=CVE-2018-16971
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-purchased course contents (quiz / test) via a modified id parameter. Wisetail Learning Ecosystem (LE) hasta la versión v4.11.6 permite ataques IDOR (Insecure Direct Object Reference) para acceder a contenidos (quiz / test) de cursos no comprados mediante un parámetro id modificado. Wisetail Learning Ecosystem (LE) versions up to 4.11.6 suffer from multiple insecure direct object reference vulnerabilities that allow an attacker to download files and get access to the non-purchased course quiz test via a modified id parameter. • https://blog.ziaurrashid.com/wisetail-learning-ecosystem-multiple-idor-vunlerability • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16970 – Wisetail Learning Ecosystem 4.11.6 Insecure Direct Object Reference
https://notcve.org/view.php?id=CVE-2018-16970
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter. Wisetail Learning Ecosystem (LE) hasta la versión v4.11.6 permite ataques IDOR (Insecure Direct Object Reference) para descargar archivos de cursos no comprados mediante un parámetro id modificado. Wisetail Learning Ecosystem (LE) versions up to 4.11.6 suffer from multiple insecure direct object reference vulnerabilities that allow an attacker to download files and get access to the non-purchased course quiz test via a modified id parameter. • https://blog.ziaurrashid.com/wisetail-learning-ecosystem-multiple-idor-vunlerability • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •