« Volver al listado

CVE-2023-27259

Estado: ModificadaAlta (7.5)—

Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teacher data by unauthenticated attackers.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Idattend — Idweb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-27259",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-27259",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T20:58:00.447182Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vdp@themissinglink.com.au",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vdp@themissinglink.com.au",
      "affectedData": [
        {
          "vendor": "IDAttend Pty Ltd",
          "product": "IDWeb",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "major",
              "lessThanOrEqual": "3.1.052"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-10-25T18:17:26.527",
  "references": [
    {
      "url": "https://www.themissinglink.com.au/security-advisories/cve-2023-27259",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vdp@themissinglink.com.au"
    },
    {
      "url": "https://www.themissinglink.com.au/security-advisories/cve-2023-27259",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vdp@themissinglink.com.au",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing authentication in the GetAssignmentsDue      method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teacher data by unauthenticated attackers."
    },
    {
      "lang": "es",
      "value": "La falta de autenticación en el método GetAssignmentsDue en la aplicación IDWeb de IDAttend 3.1.052 y versiones anteriores permite que atacantes no autenticados extraigan datos confidenciales de estudiantes y profesores."
    }
  ],
  "lastModified": "2026-06-17T05:44:40.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:idattend:idweb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BAFE4C9-F4BD-4B37-87D3-B0A399AD114B",
              "versionEndIncluding": "3.1.052"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vdp@themissinglink.com.au"
}