CVE-2023-0967

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-0967
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0967.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-0967
Published
2023-04-05T00:00:00Z
Modified
2026-07-15T01:49:09.872545948Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator. This is possible because the application is vulnerable to IDOR, it does not properly validate user permissions with respect to certain actions the user can perform.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0967.json",
    "cna_assigner": "Fluid Attacks"
}
References

Affected packages

Git / github.com/third-culture-software/bhima

Affected ranges

Type
GIT
Repo
https://github.com/third-culture-software/bhima
Events
Introduced
c02fbdc57e4ce4786933410a1a64aa742d11cd5d
Last affected
c02fbdc57e4ce4786933410a1a64aa742d11cd5d
Database specific 
{
    "cpe": "cpe:2.3:a:imaworldhealth:bhima:1.27.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.27.0"
        },
        {
            "last_affected": "1.27.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

1.*
1.27.0
v1.*
v1.27.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0967.json"