Medium severity · published Oct 3, 2023
CVE-2023-32669
Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
Buddyboss · Buddyboss
2.2.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32669
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32669
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss
More from Buddyboss
5.4
CVE-2023-32671
A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9
5.4
CVE-2023-32670
Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a malicious payload through the…
5.4
CVE-2021-43334
BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field
5.3
CVE-2024-4750
BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment
5.3
CVE-2021-44692
BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user