VulnerabilityDeferred

CVE-2023-49112

This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so.

MEDIUM 6.5EPSS 0.52%

Does this matter?

Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.

Description

Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so. This issue affects Kiuwan SAST: <master.1808.p685.q13371

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.52% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-639
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.