GCVE - cpe:2.3:a:n/a:bhima:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:n/a:bhima:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	N/A (`22f567d3-1203-528c-8f0e-3eb9c2f6ca78`)
Product	Bhima (`23709296-c18b-5e7e-81be-14e89eff71a0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-0967`	vulnerable	2026-06-08 05:52:33.548253	Details available Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator. This is possible because the application is vulnerable to IDOR, it does not properly validate user permissions with respect to certain actions the user can perform. Published: 2023-04-05T00:00:00.000Z Updated: 2025-02-13T21:05:39.650Z Open on db.gcve.eu Reference links https://github.com/IMA-WorldHealth/bhima/ https://fluidattacks.com/advisories/ingrosso/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0959`	vulnerable	2026-06-08 05:52:33.537569	Details available Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF. Published: 2023-04-05T00:00:00.000Z Updated: 2025-02-13T19:00:35.668Z Open on db.gcve.eu Reference links https://github.com/IMA-WorldHealth/bhima/ https://fluidattacks.com/advisories/calamaro/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0944`	vulnerable	2026-06-08 05:52:33.490689	Details available Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password. This is possible because the application is vulnerable to IDOR, it does not correctly validate user permissions with respect to certain actions that can be performed by the user. Published: 2023-04-05T00:00:00.000Z Updated: 2025-02-13T19:08:43.496Z Open on db.gcve.eu Reference links https://fluidattacks.com/advisories/stewart/ https://github.com/IMA-WorldHealth/bhima/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.