Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-23173— Priority - Priority web Insecure direct object references (IDOR)

Quick assessment

Affected
Priority Priority web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Priority Software Priority是以色列Priority Software公司的一种 ERP 解决方案。 Priority Software Priority 存在安全漏洞。攻击者利用该漏洞可以访问 Web 应用程序在参数更改之前无法执行的某些功能。

CVSS 5.5 · Medium EPSS 0.55% · P44
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-23173

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Priority - Priority web Insecure direct object references (IDOR)
Source: CVE Program / CVE List V5
Vulnerability Description
this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get an answer that he is not authorized because he needs to log in with credentials. after he performed log in to the system there are some functionalities that the specific user is not allowed to perform because he was configured with low privileges however all the attacker need to do in order to achieve his goals is to change the value of the prog step parameter from 0 to 1 or more and then the attacker could access to some of the functionality the web application that he couldn't perform it before the parameter changed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Priority Software Priority 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Priority Software Priority是以色列Priority Software公司的一种 ERP 解决方案。 Priority Software Priority 存在安全漏洞。攻击者利用该漏洞可以访问 Web 应用程序在参数更改之前无法执行的某些功能。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Priority Priority web V22.0 ~ V22.0* -

II. Public POCs for CVE-2022-23173

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-23173

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: Priority web
Same vendor: Priority

V. Comments for CVE-2022-23173

No comments yet

Leave a comment