Insecure Direct Object Reference (IDOR) Vulnerability in Ellucian Banner 9.17
CVE-2023-49339

6.5MEDIUM

Key Information:

Vendor

Ellucian

Status
Banner
Vendor
CVE Published:
13 February 2024

What is CVE-2023-49339?

Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint.

References

https://www.ellucian.com/solutions/ellucian-banner
https://github.com/3zizme/CVE-2023-49339/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.