CVE-2024-47653

This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this vulnerability by placing or cancelling requests through API request body leading to unauthorized modification of requests belonging to the other users.

Score

CVSS 4.0 7.1 High

Status

Analyzed - vdisclose@cert-in.org.in

Published

2024-10-04

Last modified

2024-10-04

Weaknesses

CWE-266

Affected products

• Client Dashboard (Shilpi Computers)
• Client Dashboard (Shilpisoft)

References

• https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313