Auth bypass in Centralsquare Click2gov_building_permit
CVE-2023-40362
An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contracto…
Vulnerability class: Broken Access Control
EPSS: 0.007 (47.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Centralsquare Click2gov_building_permit
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Vendor Advisory, Press/Media Coverage)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-40362?
- CVE-2023-40362 is a medium-severity vulnerability in Centralsquare Click2gov_building_permit, classified under Missing Authorization. CVSS score: 4.3/10. Published 2024-01-12.
- How severe is CVE-2023-40362?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2023-40362 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.