1. Home
  2. CVE Database
  3. CVE-2022-30760
MEDIUM · 4.3

CVE-2022-30760

An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study cours...

Vulnerability Description

An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID parameter in the HTTP POST request to the FrontControllerSS endpoint.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Ihb-EgFn2Web< 2.04.09.016

Related Weaknesses (CWE)

CWE-639

References

FAQ

What is CVE-2022-30760?

CVE-2022-30760 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study cours...

How severe is CVE-2022-30760?

CVE-2022-30760 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-30760?

Check the references section above for vendor advisories and patch information. Affected products include: Ihb-Eg Fn2Web.