CVE-2023-46664
Assigner: icscert
Published: 2023-10-26T20:04:33.638Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: PolyEco1000
vendor: Sielco 
versions: status: affected
version: CPU:2.0.6 FPGA:10.19
status: affected
version: CPU:1.9.4 FPGA:10.19
status: affected
version: CPU:1.9.3 FPGA:10.19
status: affected
version: CPU:1.7.0 FPGA:10.16
status: affected
version: CPU:2.0.2 FPGA:10.19
status: affected
version: CPU:2.0.0 FPGA:10.19
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Gjoko Krstic
descriptions: supportingMedia: base64: no
type: text/html
value: 

<p></p>

<p></p>

<p>

</p><p>Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.</p>

<p></p>


value: 












Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages.








metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-284
description: CWE-284 Improper Access Control
type: CWE
source: discovery: UNKNOWN
title: Improper Access Control in Sielco PolyEco1000
x_generator: engine: Vulnogram 0.1.0-dev