CVE-2023-49112
Insecure Direct Object Reference in Kiuwan SAST
Kiuwan provides an API endpoint
/saas/rest/v1/info/application
to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so.
This issue affects Kiuwan SAST: <master.1808.p685.q13371
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Insecure Direct Object Reference in Kiuwan SAST
Kiuwan provides an API endpoint
/saas/rest/v1/info/application
to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so.
This issue affects Kiuwan SAST: <master.1808.p685.q13371
- Record
CVE-2023-49112- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
EUVDEUVD-2023-53120
Kiuwan provides an API endpoint
/saas/rest/v1/info/application
to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so.
This issue affects Kiuwan SAST: <master.1808.p685.q13371
- Record
EUVD-2023-53120- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m8h7-pff8-m5jq
Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any ...
Kiuwan provides an API endpoint
/saas/rest/v1/info/application
to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so.
This issue affects Kiuwan SAST: <master.1808.p685.q13371
- Record
GHSA-m8h7-pff8-m5jq- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
NVD
Kiuwan provides an API endpoint
/saas/rest/v1/info/application
to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so.
This issue affects Kiuwan SAST: <master.1808.p685.q13371
- Record
CVE-2023-49112- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49112 is a medium vulnerability (CVSS 6.5) in Kiuwan Sast, published June 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. No source names a fixed version.