Insecure Direct Object Reference in Kiuwan SAST
CVE-2023-49112

6.5MEDIUM

Key Information:

Vendor

Kiuwan

Status
Sast
Vendor
CVE Published:
20 June 2024

What is CVE-2023-49112?

Kiuwan provides an API endpoint

/saas/rest/v1/info/application

to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so.

This issue affects Kiuwan SAST: <master.1808.p685.q13371

Affected Version(s)

SAST <master.1808.p685.q13371

References

https://r.sec-consult.com/kiuwan
third-party-advisory
https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+C...
release-notes

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Constantin Schwarz
Johannes Greil
.