CVE-2023-28698 CRITICAL

CVE-2023-28698: WADE DIGITAL DESIGN CO, LTD. FANTSY - Broken Acesss Control

Vendor Wade Digital Design Co, Ltd.
Product FANTSY
Weakness CWE-863 · Incorrect authorization
Published June 2, 2023
Last update January 8, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt service.

Key dates

02Disclosure timeline

June 2, 2023 CVE published
January 8, 2025 Record updated