CVE-2023-50811

State: Published
Severity: 6.5 Medium
Published: Mar 19, 2024
Updated: Mar 27, 2025
Reserved: Dec 14, 2023

Description

An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many other receptions in addition the assigned one.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	CISA-ADP

Weaknesses

CWE-863 Incorrect Authorization
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://www.gruppotim.it/it/footer/red-team.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.