CVE-2024-56883: High severity sage dpw vulnerability
Sage DPW before 202412001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the option to do so in the user interface. To do this, a valid request to create a course simply needs to be modified, so that the current user ID in the "id" parameter is replaced with the ID of another user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56883?
CVE-2024-56883 is classified as a low severity vulnerability.
How do I fix CVE-2024-56883?
To fix CVE-2024-56883, upgrade Sage DPW to version 2024_12_002 or later.
What issue does CVE-2024-56883 address?
CVE-2024-56883 addresses incorrect access control due to insufficient enforcement of role-based access controls.
Who is affected by CVE-2024-56883?
CVE-2024-56883 affects low-privileged Sage users with employee role privileges in Sage DPW before version 2024_12_002.
Can CVE-2024-56883 lead to data exposure?
Yes, CVE-2024-56883 can potentially lead to the unauthorized creation of external courses for other employees, risking data exposure.