{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-28698", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "dateUpdated": "2023-06-02T00:00:00", "dateReserved": "2023-03-21T00:00:00", "datePublished": "2023-06-02T00:00:00"}, "containers": {"cna": {"title": "WADE DIGITAL DESIGN CO, LTD. FANTSY - Broken Acesss Control", "datePublic": "2023-05-11T00:00:00", "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-06-02T00:00:00"}, "descriptions": [{"lang": "en", "value": "Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt service."}], "affected": [{"vendor": "WADE DIGITAL DESIGN CO, LTD.", "product": "FANTSY", "versions": [{"version": "2.1.8", "status": "affected"}]}], "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7101-f88db-1.html"}], "credits": [{"lang": "en", "value": "Dio Lin (CHT)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "TVN-202304001", "discovery": "EXTERNAL"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wddgroup:fantsy:2.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "860FED5B-4EC5-47A7-8053-192326ED74FE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt service."}, {"lang": "es", "value": "Wade Graphic Design FANTSY tiene una vulnerabilidad de comprobaci\u00f3n de autorizaci\u00f3n insuficiente. Un usuario remoto no autenticado puede explotar esta vulnerabilidad modificando los par\u00e1metros de la URL para obtener privilegios de administrador y realizar operaciones arbitrarias en el sistema o interrumpir el servicio. "}], "id": "CVE-2023-28698", "lastModified": "2023-06-09T17:25:28.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Primary"}]}, "published": "2023-06-02T11:15:10.230", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7101-f88db-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "twcert@cert.org.tw", "type": "Primary"}]}

{}