CVE-2011-3645

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-09-27 · updated 2026-06-16
Weakness: CWE-264

Description

Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects the settings page of an arbitrary user.

Affected products

Newgensoft Omnidocs: all versions

References

http://seclists.org/fulldisclosure/2011/Sep/283
http://securityreason.com/securityalert/8394
http://www.exploit-db.com/exploits/17897
http://seclists.org/fulldisclosure/2011/Sep/283
http://securityreason.com/securityalert/8394
http://www.exploit-db.com/exploits/17897

Get alerted when CVE-2011-3645 or the next vulnerability affects your stack