CVE-2023-36238: Bagisto vulnerable to Insecure Direct Object Reference (IDOR)
Bagisto vulnerable to Insecure Direct Object Reference (IDOR)
Other sources
Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.0 allows an attacker to obtain sensitive information via the invoice ID parameter.
— GitHub
Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/bagisto/bagistoto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-36238?
CVE-2023-36238 has a medium severity level due to its potential to expose sensitive information.
What versions of Bagisto are affected by CVE-2023-36238?
CVE-2023-36238 affects Bagisto versions 1.5.0 and 1.5.1.
How do I fix CVE-2023-36238?
To fix CVE-2023-36238, upgrade Bagisto to version 1.5.2 or later.
What type of vulnerability is CVE-2023-36238?
CVE-2023-36238 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.
What can an attacker do with CVE-2023-36238?
An attacker can exploit CVE-2023-36238 to access sensitive information via the invoice ID parameter.