PT-2022-20218 · Unknown · Supersmart

Nerya Zadkani · Published 2022-07-21 · Updated 2022-07-27 · CVE-2022-30628

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Supersmart (affected versions not specified)

Description The issue allows downloading all receipts without authentication. To exploit this, an attacker must first access the API endpoint "https://XXXX.supersmart.me/services/v4/customer/signin" to obtain a TOKEN. Then, they can access the API that provides invoice images based on the URL "https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-30628

Affected Products

Supersmart

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-30628 · Security Note
• https://gov.il/en/Departments/faq/cve_advisories · Note
• https://t.me/cibsecurity/46762 · Telegram Post