IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
Summary
IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
Original description
The description as published by the source.
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov