CVE-2023-4617
published 2024-12-19CVE-2023-4617: Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other…
PriorityP258critical10CVSS 3.1
AVNACLPRNUINSCCLIHAH
EPSS
0.57%
42.9th percentile
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values.
This issue affects Govee Home applications on Android and iOS in versions before 5.9.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| govee | govee_home | < 5.9 | 5.9 |
| pimcore | pimcore | >= 0 < 10.5.21 | 10.5.21 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-59pp-rvhc-93rh: Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned
ghsa_unreviewed·2024-12-19
CVE-2023-4617 [CRITICAL] CWE-863 GHSA-59pp-rvhc-93rh: Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values.
This issue affects Govee Home applications on Android and iOS in versions before 5.9.
GHSA
Pimcore Cross-site Scripting (XSS) in name field of Custom Reports
ghsa·2023-05-10
CVE-2023-2614 [MEDIUM] Pimcore Cross-site Scripting (XSS) in name field of Custom Reports
Pimcore Cross-site Scripting (XSS) in name field of Custom Reports
### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
### Patches
Update to version 10.5.21 or apply this patch manually:
https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7.patch
### Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7.patch
### References
https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-19
Published