PT-2026-54829 · Mco · Mco
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
MCO version 25.3.3.1
Description
An Insecure Direct Object Reference (IDOR) exists in the '/customer/servlet/mco/webapi/trading-document/fetchPdfStatement' endpoint. The application fails to properly validate if an authenticated user is authorized to access a specific document, allowing the retrieval of files based on a user-supplied identifier. An attacker can access trading documents of other users by providing a valid document ID. While this requires guessing the identifier, predictable ID patterns make enumeration feasible, potentially leading to the unauthorized disclosure of sensitive information.
Recommendations
For version 25.3.3.1, restrict access to the '/customer/servlet/mco/webapi/trading-document/fetchPdfStatement' endpoint to ensure users can only access their own documents. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mco