Threats tagged 'ghsa-gwjq-fm88-774x'

eGovFramework/egovframe-common-components versions up to and including 4.3.1 have a vulnerability in their Web Editor image upload functionality. The system uses symmetric encryption to protect URL parameters but exposes an encryption oracle that allows attackers to generate valid ciphertext for chosen values. This flaw enables unauthenticated attackers to bypass access controls relying on encrypted parameters and retrieve arbitrary stored files without proper authorization.