CVE-2024-47653 — Missing Authorization Vulnerability

CVE-2024-47653

Missing Authorization Vulnerability PUBLISHED

Description (CNA)

This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this vulnerability by placing or cancelling requests through API request body leading to unauthorized modification of requests belonging to the other users.

Affected (CNA)

Vendor / product	Versions
Shilpi Computers / Client Dashboard	affected <9.7.0

CWE

CWE-266

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.