Description

The API exposes sensitive information (Personally Identifiable Information (PII)) due to a vulnerability in the authorization process. An unauthenticated attacker can gain access to the personal data.

Remediation

Implement a robust authorization mechanism

References

API1:2019 Broken Object Level Authorization

API3:2019 Excessive Data Exposure

Related Vulnerabilities

WordPress Plugin Page Flip Image Gallery 'book_id' Parameter Remote File Disclosure (0.2.2)

WordPress Plugin Count per Day Arbitrary File Download and Cross-Site Scripting Vulnerabilities (3.1)

SharePoint user enumeration

MongoDB HTTP status interface

Symfony debug mode enabled

Severity

High

Classification

CWE-284 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure