What is GHSA-pmc7-hmmw-g96q?

GHSA-pmc7-hmmw-g96q is a security advisory published by GitHub Security Advisories with Medium severity. Bagisto vulnerable to Insecure Direct Object Reference (IDOR)

Which CVE IDs does GHSA-pmc7-hmmw-g96q cover?

GHSA-pmc7-hmmw-g96q covers the following CVE IDs: CVE-2023-36238. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pmc7-hmmw-g96q?

GHSA-pmc7-hmmw-g96q has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-pmc7-hmmw-g96q?

GHSA-pmc7-hmmw-g96q affects 1 product, including: composer/bagisto/bagisto:\u003c 1.3.2.

GHSA-pmc7-hmmw-g96qMediumCVSS 6.5

Bagisto vulnerable to Insecure Direct Object Reference (IDOR)

Vendor

GitHub Security Advisories

Published

March 13, 2024

Last Modified

December 4, 2024

🔗 CVE IDs covered (1)

CVE-2023-36238 →

📋 Description

Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.0 allows an attacker to obtain sensitive information via the invoice ID parameter.

🎯 Affected products1

composer/bagisto/bagisto:< 1.3.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-36238
https://github.com/Ek-Saini/security/blob/main/IDOR-Bagisto
https://github.com/bagisto/bagisto/pull/4697
https://github.com/bagisto/bagisto/commit/2a24098cb582e072c87177e0ad17be45f240ad17
https://github.com/advisories/GHSA-pmc7-hmmw-g96q