GitHub Advisoryadvisory · Packagist

GHSA-36cm-h8gv-mg97 RosarioSIS Stores Sensitive Data in a Mechanism without Access Control

HIGH Published 2023-05-19 Modified 2023-05-19 Official page ↗
Aliases
CVE-2023-2665
Ecosystem
Packagist
Packages
francoisjacquet/rosariosis
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-921, CWE-922
Reviewed
2023-05-19

Affected packages

• Packagist francoisjacquet/rosariosis: < 11.0 → fixed in 11.0

Description

RosarioSIS prior to 11.0 allows anyone, regardless of authentication status, to download and view file attachments under the `salaries` module. In addition, the file names contain a date in a `YYYY-MM-DD` format and a random six-string digit, making enumerating file names with automated tools relatively easy. This could allow an attacker to gain access to sensitive salary information. The patch for version 11.0 adds microseconds to filenames to make them harder to guess.

Related

Alias · CVE (1)

  • CVE-2023-2665 Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. vulnerability

Weakness · CWE (2)

  • CWE-921 Storage of Sensitive Data in a Mechanism without Access Control weakness
  • CWE-922 Insecure Storage of Sensitive Information weakness

References