What’s Vulnerable › Vulnerabilities

CVE-2023-25780: Status Internet Co.,Ltd. PowerBPM - Broken Access Control

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-02 · updated 2026-06-17
• Weakness: CWE-306

Description

It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence.

Affected products

• Status Internet Co.,Ltd. PowerBPM: 2.0

References

• https://www.twcert.org.tw/tw/cp-132-7152-d7f5b-1.html
• https://www.twcert.org.tw/tw/cp-132-7152-d7f5b-1.html

Get alerted when CVE-2023-25780 or the next vulnerability affects your stack