Описание
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2021-36388
- https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities
- https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.md
- https://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.html
- https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6
- http://seclists.org/fulldisclosure/2021/Oct/15
Связанные уязвимости
CVSS3: 7.5
nvd
больше 4 лет назад
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".