CVE-2022-31883
HIGHmarval_msm 14.19.0.12476 - Authorization Bypass via Insecure Direct Object Reference
Title source: llmDescription
Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.
References (3)
Core 3
Core References
Broken Link, Third Party Advisory x_refsource_misc
https://drive.google.com/drive/folders/17Q8ItseCzj5W7wlD6ZFqL0y1N5Emxz4_?usp=sharing
Product, Vendor Advisory x_refsource_misc
https://marvalglobal.com/
Third Party Advisory x_refsource_misc
https://cyber-guy.gitbook.io/cyber-guy/pocs/marval-msm/idor-leads-to-unauthorized-access-to-api-keys
Scores
CVSS v3
8.8
EPSS
0.0091
EPSS Percentile
55.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-639
Status
published
Products (1)
marvalglobal/marval_msm
14.19.0.12476
Published
Jun 28, 2022
Tracked Since
Feb 18, 2026