CVEvulnerability
CVE-2020-35737
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-12-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Description
In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference.
Affected configurations
• newgensoft egov 12.0
References
- http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html Exploit, Third Party Advisory, VDB Entry
- https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486 Third Party Advisory
- https://www.exploit-db.com/exploits/49378 Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html Exploit, Third Party Advisory, VDB Entry
- https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486 Third Party Advisory
- https://www.exploit-db.com/exploits/49378 Exploit, Third Party Advisory, VDB Entry