idweb vulnerabilities and fixes

Recent CVEs affecting idweb, with upgrade or downgrade steps. 30 tracked.

idweb has 30 tracked vulnerabilities, 11 critical. A fixed release or vendor patch exists for 28. Most recent: 2023-10-25. Highest priority: CVE-2023-27262 (score 55/100).

• CVE-2023-27377 HIGH 7.5 UPGRADE Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb ap
• CVE-2023-27376 HIGH 7.5 UPGRADE Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application
• CVE-2023-27375 HIGH 7.5 UPGRADE Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application
• CVE-2023-27262 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 a
• CVE-2023-27261 MEDIUM 5.3 UPGRADE Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and ear
• CVE-2023-27260 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 a
• CVE-2023-27259 HIGH 7.5 UPGRADE Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlie
• CVE-2023-27258 HIGH 7.5 UPGRADE Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and e
• CVE-2023-27257 HIGH 7.5 UPGRADE Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earl
• CVE-2023-27256 MEDIUM 5.8 UPGRADE Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows
• CVE-2023-27255 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend’s IDWeb application 3.1.052 an
• CVE-2023-27254 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and ea
• CVE-2023-26584 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetStudentInconsistencies method in IDAttend’s IDWeb application 3.1.
• CVE-2023-26583 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and ea
• CVE-2023-26582 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend’s IDWeb application 3.1.052 and
• CVE-2023-26581 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetVisitors method in IDAttend’s IDWeb application 3.1.052 and earlier a
• CVE-2023-26580 HIGH 7.5 UPGRADE Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any fi
• CVE-2023-26579 MEDIUM 5.3 DOWNGRADE Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of st
• CVE-2023-26578 HIGH 8.8 DOWNGRADE Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers t
• CVE-2023-26577 HIGH 7.5 UPGRADE Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack
• CVE-2023-26576 HIGH 7.5 UPGRADE Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier
• CVE-2023-26575 HIGH 7.5 UPGRADE Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier
• CVE-2023-26574 HIGH 7.5 UPGRADE Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows
• CVE-2023-26573 HIGH 8.2 UPGRADE Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial o
• CVE-2023-26572 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earli
• CVE-2023-26571 HIGH 7.5 UPGRADE Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allo
• CVE-2023-26570 HIGH 7.5 UPGRADE Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and
• CVE-2023-26569 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.
• CVE-2023-26568 CRITICAL 9.8 UPGRADE Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 an
• CVE-2023-1356 HIGH 7.5 UPGRADE Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earl

FAQ

How do I fix idweb vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is idweb being exploited right now?

None of the tracked idweb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which idweb CVE should I patch first?

CVE-2023-27262 currently ranks highest (55/100): Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 a.

RSS feed for idweb · ← Back to latest CVEs