high7.5Public exploit code
CVE-2011-3645
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Omnidocs - Multiple Vulnerabilities2011-09-27 · webapps · jsp
Impact
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects the settings page of an arbitrary user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Newgensoft | Omnidocs | All versions |