IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
Résumé
IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
Description d'origine
La description telle que publiée par la source (souvent en anglais).
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov