Incorrect Access Control in Reportico
Summary
CVE-2023-48865: Reportico affected by Incorrect Access Control. Affects reportico-web/reportico versions < 8.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Reportico is a package available on Packagist that provides a web-based reporting tool for generating reports from various data sources. It offers a user-friendly interface and supports different report formats. However, an issue has been discovered in Reportico Till 8.1.0 that allows attackers to obtain sensitive information by manipulating the 'execute_mode' parameter in the URL.
Vulnerability Detail
The vulnerability in Reportico arises from incorrect access control. Attackers can exploit this flaw by modifying the 'execute_mode' parameter in the URL to gain unauthorized access to sensitive information. This could lead to the exposure of confidential data, such as database credentials or other sensitive information stored within the application. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a newer version of Reportico is not immediately feasible, a temporary workaround can be implemented by manually validating and sanitizing the 'execute_mode' parameter in the application code. This can be done by ensuring that only authorized users have access to the sensitive functionality and data.
Conclusion
In conclusion, the vulnerability in Reportico allows attackers to gain unauthorized access to sensitive information. It is crucial to upgrade to a version beyond 8.1.0 or implement the recommended workaround to mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for reportico-web/reportico →
FAQ
Reportico is a web-based reporting tool that allows users to generate reports from various data sources.
The vulnerability allows attackers to obtain sensitive information, potentially leading to the exposure of confidential data stored within the application.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade Reportico to a version beyond 8.1.0.
Yes, a temporary workaround can be implemented by manually validating and sanitizing the 'execute_mode' parameter in the application code.
Related vulnerabilities
Recent vulnerabilities recorded for reportico-web/reportico.
