CVE-2020-35737

High · 7.5

CVSS

7.5

EPSS

10.4%

Published

Dec 30, 2020

CISA due date

—

The record

In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference.

Affected packages

Ecosystem	Package	Introduced	Fixed