CVE-2024-25635
Assigner: GitHub_M
Published: 2024-02-19T19:48:10.379Z
State: PUBLISHED
title: IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
problemTypes: descriptions: cweId: CWE-612
description: CWE-612: Improper Authorization of Index Containing Sensitive Information
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
affected: vendor: alfio-event
product: alf.io
versions: version: < 2.0-M4-2402
status: affected
descriptions: value: alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.
source: advisory: GHSA-ffr5-g3qg-gp4f
discovery: UNKNOWN