What is CVE-2018-16606?

CVE-2018-16606 is a medium-severity vulnerability in Proconf, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2018-09-06.

How severe is CVE-2018-16606?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2018-16606 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Proconf

CVE-2018-16606

In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and their authors' personal information (Name, Email, Organization, and Position) by changing the value of Paper ID (the pid parameter).

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.059 (92.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Proconf
N/a — versions n/a

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-16606?: CVE-2018-16606 is a medium-severity vulnerability in Proconf, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2018-09-06.
How severe is CVE-2018-16606?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2018-16606 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.