Описание
The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:gencat:portal_d\'acces_a_la_universitat:1.7.5:*:*:*:*:*:*:*
EPSS
Процентиль: 44%
0.00216
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-706
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
The Java API in Generalitat de Catalunya accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints, given that the attacker is authenticated as a student: 1) https://accesuniversitat.gencat.cat/accesuniversitat/accesuniversitat-rs/AppJava/api/v1/estudiants/{student_id}/ 2) https://accesuniversitat.gencat.cat/accesuniversitat/accesuniversitat-rs/AppJava/api/v1/estudiants/?page={page}.
EPSS
Процентиль: 44%
0.00216
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-706