Movo
Monthly
Authorization bypass in MOVO through 0.2.3 lets any authenticated user read other users' stored private documents and overwrite their presentation blueprints through the chat-api document endpoints, because the server accepts an attacker-supplied object path without verifying that the object belongs to the requester. Exploitation requires a valid MOVO account and advance knowledge or enumeration of the victim's object path, so the attack is bounded by path secrecy rather than being fully attacker-controlled, and no victim interaction is needed. Publicly available exploit code exists, and both the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N, C/I impact) agree the impact is a high-confidentiality, lower-integrity exposure confined to the vulnerable application rather than a platform-wide compromise; signals are moderately consistent and point to a real but bounded risk.
Authorization bypass in MOVO through 0.2.3 lets any authenticated user read other users' stored private documents and overwrite their presentation blueprints through the chat-api document endpoints, because the server accepts an attacker-supplied object path without verifying that the object belongs to the requester. Exploitation requires a valid MOVO account and advance knowledge or enumeration of the victim's object path, so the attack is bounded by path secrecy rather than being fully attacker-controlled, and no victim interaction is needed. Publicly available exploit code exists, and both the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N, C/I impact) agree the impact is a high-confidentiality, lower-integrity exposure confined to the vulnerable application rather than a platform-wide compromise; signals are moderately consistent and point to a real but bounded risk.