286 – Insecure object reference - Personal information
Description
The system allows bypassing authentication mechanisms and modifying other users information by altering the unique identifiers that distinguish each user.
Impact
Modify information of other users.
Recommendation
- Validate that unprivileged users can only access and modify their own information. - Manage user operations using session objects.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X