Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator. This is possible because the application is vulnerable to IDOR, it does not properly validate user permissions with respect to certain actions the user can perform.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/ingrosso/ | Exploit |
| https://fluidattacks.com/advisories/ingrosso/ | Exploit |
| https://github.com/IMA-WorldHealth/bhima/ | Product |
| https://github.com/IMA-WorldHealth/bhima/ | Product |
Configurations
History
13 Feb 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/IMA-WorldHealth/bhima/ - Product | |
| References | () https://fluidattacks.com/advisories/ingrosso/ - Exploit |
17 Apr 2023, 17:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://fluidattacks.com/advisories/ingrosso/ - Exploit | |
| References | (MISC) https://github.com/IMA-WorldHealth/bhima/ - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-639 | |
| CPE | cpe:2.3:a:imaworldhealth:bhima:1.27.0:*:*:*:*:*:*:* | |
| First Time |
Imaworldhealth
Imaworldhealth bhima |
05 Apr 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-05 20:15
Updated : 2025-02-13 21:15
NVD link : CVE-2023-0967
Mitre link : CVE-2023-0967
JSON object : View
Products Affected
imaworldhealth
- bhima
CWE
CWE-639
Authorization Bypass Through User-Controlled Key