GitHub Advisoryadvisory · Packagist

GHSA-4v4p-87m3-5423 Known v1.3.1 contains Insecure Direct Object Reference

MEDIUM Published 2022-07-09 Modified 2022-07-20 Official page ↗
Aliases
CVE-2022-30852
Ecosystem
Packagist
Packages
idno/known
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-639
Reviewed
2022-07-20

Affected packages

• Packagist idno/known: <= 1.3.1 (no fix yet)

Description

Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR). The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.

Related

Alias · CVE (1)

  • CVE-2022-30852 Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR). vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References