CVE-2023-40362
Last modified
CVE-2023-40362 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known.. EPSS estimates a 0.67% chance of exploitation in the next 30 days.
Description
An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Centralsquare | Click2gov Building Permit | All versions |
References
- https://github.com/ally-petitt/CVE-2023-40362Exploit, Third Party Advisory
- https://www.classaction.org/news/centralsquare-hit-with-class-action-over-2017-2018-click2gov-data-breachPress/Media Coverage, Vendor Advisory
- https://github.com/ally-petitt/CVE-2023-40362Exploit, Third Party Advisory
- https://www.classaction.org/news/centralsquare-hit-with-class-action-over-2017-2018-click2gov-data-breachPress/Media Coverage, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-40362?
How severe is CVE-2023-40362?
How do I fix CVE-2023-40362?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-40356PingOne MFA Integration Kit contains a vulnerability related…8.7
- CVE-2023-40357Multiple TP-LINK products allow a network-adjacent authentic…8
- CVE-2023-40359xterm before 380 supports ReGIS reporting for character-set …9.8
- CVE-2023-4036The Simple Blog Card WordPress plugin before 1.32 does not e…4.3
- CVE-2023-40360QEMU through 8.0.4 accesses a NULL pointer in nvme_directive…5.5
- CVE-2023-40361SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for t…7.8
- CVE-2023-40363IBM InfoSphere Information Server 11.7 could allow an authen…6.5
- CVE-2023-40367IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting.…5.4
- CVE-2023-40368IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a p…4.4
- CVE-2023-4037Blind SQL injection vulnerability in the Conacwin 3.7.1.2 we…5.5
- CVE-2023-40370 IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runt…5.3
- CVE-2023-40371IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could al…5.5
Are you affected by CVE-2023-40362?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST