Vulnerability in Newgensoft Omnidocs
CVE-2011-3645
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects the settings page of an arbitrary user.
EPSS: 0.027 (84.3th percentile) — read the EPSS interpretation.
Affected products
- Newgensoft Omnidocs
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)