CVEvulnerability
CVE-2023-40362
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-01-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-862
Description
An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known.
Affected configurations
• centralsquare click2gov building permit
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/ally-petitt/CVE-2023-40362 Exploit, Third Party Advisory
- https://www.classaction.org/news/centralsquare-hit-with-class-action-over-2017-2018-click2gov-data-breach Press/Media Coverage, Vendor Advisory
- https://github.com/ally-petitt/CVE-2023-40362 Exploit, Third Party Advisory
- https://www.classaction.org/news/centralsquare-hit-with-class-action-over-2017-2018-click2gov-data-breach Press/Media Coverage, Vendor Advisory