GHSA-4v4p-87m3-5423

Source

https://github.com/advisories/GHSA-4v4p-87m3-5423

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-4v4p-87m3-5423/GHSA-4v4p-87m3-5423.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4v4p-87m3-5423

Aliases

CVE-2022-30852

Published

2022-07-09T00:00:26Z

Modified

2024-02-21T05:33:25.760197Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Known v1.3.1 contains Insecure Direct Object Reference

Details

Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).

The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the dev branch of the idno/known repository.

Database specific

{
    "nvd_published_at": "2022-07-08T12:15:00Z",
    "cwe_ids": [
        "CWE-639"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-20T01:32:06Z"
}

References

Affected packages

Packagist / idno/known

Package

Name: idno/known
Purl: pkg:composer/idno/known

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.3.1

Affected versions

1.*

1.0.0-rc.1

1.0.0-rc.3

1.0.0

1.2.2