同じ製品で同じ時期に公表された 3 件の脆弱性の 1 つです。まとめた解説: MatchPointに脆弱性7件、アプリを最新版へ更新
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the ...
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- web incibe.es
- web nvd.nist.gov
- web github.com