CVE-2023-49112

Insecure Direct Object Reference in Kiuwan SAST

CVSS 6.5 MEDIUMEPSS 0.5%CWE-639

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

20 jun 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so. This issue affects Kiuwan SAST: <master.1808.p685.q13371

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

Kiuwan · SAST

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://seclists.org/fulldisclosure/2024/Jun/3 https://r.sec-consult.com/kiuwan https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log