CVE-2020-35737
high · 7.5In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference.
7.5
CVSS
10.3%
EPSS (exploit prob.)
95th
EPSS percentile
2020-12-30
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| newgensoft | egov | 12.0 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html
- https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486
- https://www.exploit-db.com/exploits/49378
- http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html
- https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486
- https://www.exploit-db.com/exploits/49378
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-35737