Description (CNA)
A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Issuetrak / Issuetrak | affected Issuetrak 17.1 |
CWE
CWE-472, CWE-837
References
ADP enrichment
No English description supplied.
No references supplied.