Description
In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of other users.
Medium · 6.5
CVE-2020-26175
EUVD-2020-18800GHSA-v8w3-7f3w-x353
In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change pr…
Published Dec 18, 2020 · Updated Aug 4, 2024 · Assigned by mitre