CVE-2023-32669
Last modified
CVE-2023-32669 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Buddyboss | Buddyboss | 2.2.9 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-32669?
How severe is CVE-2023-32669?
How do I fix CVE-2023-32669?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-32662Improper authorization in some Intel Battery Life Diagnostic…6.7
- CVE-2023-32663Incorrect default permissions in some Intel(R) RealSense(TM)…7.8
- CVE-2023-32664A type confusion vulnerability exists in the Javascript chec…7.8
- CVE-2023-32665A flaw was found in GLib. GVariant deserialization is vulner…5.5
- CVE-2023-32666On-chip debug and test interface with improper access contro…7.2
- CVE-2023-32668LuaTeX before 1.17.0 allows a document (compiled with the de…5.5
- CVE-2023-3267When adding a remote backup location, an authenticated user …8.8
- CVE-2023-32670Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 vers…5.4
- CVE-2023-32671A stored XSS vulnerability has been found on BuddyBoss Platf…5.4
- CVE-2023-32672An Incorrect authorisation check in SQLLab in Apache Superse…4.3
- CVE-2023-32673Certain versions of HP PC Hardware Diagnostics Windows, HP I…9.8
- CVE-2023-32674Certain versions of HP PC Hardware Diagnostics Windows are p…9.8
Are you affected by CVE-2023-32669?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST