CVE-2020-35737

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

10.31%

Published

Dec 30, 2020

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index Exploit-DBNewgen Correspondence Management System (corms) eGov 12.0 - IDOR

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products (1)

newgensoft · egovvulnerable

References (6)

http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html

ExploitThird Party AdvisoryVDB Entry

https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486

Third Party Advisory

https://www.exploit-db.com/exploits/49378

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html

ExploitThird Party AdvisoryVDB Entry

https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486

Third Party Advisory

https://www.exploit-db.com/exploits/49378

ExploitThird Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs