Vulnerability Details CVE-2022-30760
An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID parameter in the HTTP POST request to the FrontControllerSS endpoint.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 33.9%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
Products affected by CVE-2022-30760
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.000
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.001
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.002
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.003
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.004
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.005
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.006
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.007
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.008
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.009
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.010
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.011
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.012
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.013
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.014
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.015
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.016
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.017
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.018
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.019
-
cpe:2.3:a:ihb-eg:fn2web:2.04.06.020
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.000
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.001
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.002
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.003
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.004
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.005
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.006
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.007
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.008
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.009
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.010
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.011
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.012
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.013
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.014
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.015
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.016
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.017
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.018
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.019
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.020
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.021
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.022
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.023
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.024
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.025
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.026
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.027
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.028
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.029
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.030
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.031
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.032
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.033
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.034
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.035
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.036
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.037
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.038
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.039
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.040
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.041
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.042
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.043
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.044
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.045
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.046
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.047
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.048
-
cpe:2.3:a:ihb-eg:fn2web:2.04.07.049
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.000
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.001
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.002
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.003
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.004
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.005
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.006
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.007
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.008
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.009
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.010
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.011
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.012
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.014
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.015
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.016
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.017
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.018
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.019
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.020
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.021
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.022
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.023
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.024
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.025
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.026
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.027
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.028
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.029
-
cpe:2.3:a:ihb-eg:fn2web:2.04.08.030
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.000
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.001
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.002
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.003
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.004
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.005
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.006
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.007
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.008
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.009
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.010
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.011
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.012
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.013
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.014
-
cpe:2.3:a:ihb-eg:fn2web:2.04.09.015