title: Tad Uploader - Improper Authorization
description: Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.
problem types: CWE-285 Improper Authorization
affected:
{
product: Uploader
vendor: Tad
versions:
lessThanOrEqual: 3.5.3, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
solutions: Update Tad Uploader version to 3.5.4