CVE-2022-24187

Katalog CVE

CVSS 7.5 · High EPSS 0,78%

Kerentanan Authorization Bypass Through User-Controlled Key pada sz-fujia ourphoto. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an attacker to discover sensitive information such as end-user email addresses, and their unique frame_token value of all other Ourphoto App end-users.

Rincian

Terbit di NVD

28 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.scrawledsecurityblog.com/2022/11/automating-unsolicited-richard-pics.html exploit · deskripsi teknis · advisory pihak ketiga
• https://apps.apple.com/us/app/ourphoto-keep-our-memories/id1476241568 product