https://trustcves.github.io/tags/authorization/Recent content in Authorization on Vulnerability DisclosureHugoenWed, 12 Feb 2025 12:49:22 +0000https://trustcves.github.io/posts/cve-cve-2024-56883/writeup/Wed, 12 Feb 2025 12:49:22 +0000https://trustcves.github.io/posts/cve-cve-2024-56883/writeup/<p><strong>Affected Product:</strong> Sage DPW</p> <p><strong>Affected Versions:</strong> &lt; 2024_12_001</p> <p><strong>Fixed Version:</strong> 2024_12_001</p> <p><strong>CVE-Number:</strong> CVE-2024-56883</p> <p><strong>Severity:</strong> 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)</p> <p><em>Discovered by Regina Kohl, BSc and Maximilian Zingerle, BSc</em></p> <p>During a penetration test for a customer, the audit team discovered an incorrect access control vulnerability in Sage DPW that allows unauthorized modification of course assignments between users.</p> <h2 id="proof-of-concept">Proof of Concept</h2> <p>It is possible for a user with the MA role to create a course for another user who also has the MA role, even though the latter does not have the option to do so in the user interface.</p>