Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Inova Partner lets logged‑in users access data they shouldn’t

CVE-2018-15693 · published 7 years ago
Summary

Inova Partner version 5.0.5-RELEASE, Build 0510-0906 and earlier lets anyone who can log in bypass normal permission checks. This means a user could view or change information they are not supposed to see. Apply the latest update from Inova Software or follow their guidance to restrict access until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
inova-software inova_partner <= 5.0.5
cpe:2.3:a:inova-software:inova_partner:*:*:*:*:*:*:*:*
Original advisory text
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference.
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published16 Nov 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-15693 · NVD
Track software like this
Free during beta