Vulnerability DatabaseCVE-2023-4124

CVE-2023-4124:
vulnerability analysis and mitigation

Overview

A Missing Authorization vulnerability was identified in GitHub repository answerdev/answer prior to version 1.1.1, tracked as CVE-2023-4124. The vulnerability was discovered and disclosed in August 2023, affecting the Answer platform's authorization system (NVD).

Technical details

The vulnerability has been classified with a CVSS v3.1 base score of 6.5 (MEDIUM) by NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, while huntr.dev assessed it with a higher score of 8.1 (HIGH) with vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The vulnerability is categorized as CWE-862 (Missing Authorization) (NVD).

Impact

The vulnerability could potentially allow an attacker with low privileges to perform unauthorized actions, particularly affecting the integrity of the system. The high impact on integrity (I:H) suggests that attackers could modify data or functionality without proper authorization (NVD).

Mitigation and workarounds

The vulnerability has been patched in version 1.1.1 of the Answer platform. Users are advised to upgrade to this version or later to mitigate the security risk. The fix includes improvements to the authorization system and privilege handling (GitHub Patch).