PT-2019-12977 · Generalitat De Catalunya · Accesuniversitat.Gencat.Cat

Avm99963 · Publicado 2019-12-31 · Atualizado 2021-07-21 · CVE-2019-12837

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions accesuniversitat.gencat.cat version 1.7.5

Description The Java API in the affected software allows remote attackers to obtain personal information of all registered students via several API endpoints.

Recommendations For version 1.7.5, consider restricting access to the API endpoints until a patch is available. As a temporary workaround, limit the information that can be retrieved through the API to minimize the risk of exploitation.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

CWE-706

Identificadores relacionados

CVE-2019-12837

Produtos afetados

Accesuniversitat.Gencat.Cat

Referências · 3

• 🔥 https://vulnz.avm99963.com/T15 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12837 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12837 · Aviso do Fabricante