« Volver al listado

CVE-2023-26580

Estado: ModificadaAlta (7.5)—

Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Idattend — Idweb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-26580",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-26580",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T20:58:08.054752Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vdp@themissinglink.com.au",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vdp@themissinglink.com.au",
      "affectedData": [
        {
          "vendor": "IDAttend Pty Ltd",
          "product": "IDWeb",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "major",
              "lessThanOrEqual": "3.1.052"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-10-25T18:17:25.950",
  "references": [
    {
      "url": "https://www.themissinglink.com.au/security-advisories/cve-2023-26580",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vdp@themissinglink.com.au"
    },
    {
      "url": "https://www.themissinglink.com.au/security-advisories/cve-2023-26580",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vdp@themissinglink.com.au",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers.  "
    },
    {
      "lang": "es",
      "value": "Un archivo arbitrario no autenticado leído en la aplicación IDWeb 3.1.013 de IDAttend permite la recuperación de cualquier archivo presente en el servidor web por parte de atacantes no autenticados."
    }
  ],
  "lastModified": "2026-06-17T05:43:38.607",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:idattend:idweb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BAFE4C9-F4BD-4B37-87D3-B0A399AD114B",
              "versionEndIncluding": "3.1.052"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vdp@themissinglink.com.au"
}