CVE-2011-3645 Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a mo...
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects the settings page of an arbitrary user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| newgensoft omnidocs | All versions | No fix listed |
References
- 20110926 [CVE-2011-3645] Multiple vulnerability in "Omnidocs" mailing-list
- 8394 third-party-advisory
- 17897 exploit