{"id":"CVE-2019-12837","aliases":["EUVD-2019-4417","GHSA-84qr-xgvg-w6h2"],"status":"published","title":"The Java API in Generalitat de Catalunya accesuniversitat.gencat.cat 1.7.5 allows remote...","description":"The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01105,"percentile":0.66023,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-706","CWE-863"],"published":"2019-12-31T16:53:35Z","modified":"2026-06-17T02:15:35Z","products":[{"vendor":"gencat","product":"portal_d\\'acces_a_la_universitat"}],"references":[{"url":"https://vulnz.avm99963.com/T15","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12837"},{"url":"https://github.com/advisories/GHSA-84qr-xgvg-w6h2"}],"sources":{"cve":[{"id":"CVE-2019-12837","description":"The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.","status":"published","published":"2019-12-31T16:53:35Z","modified":"2024-08-04T23:32:55.181Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2019-4417","description":"The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.","status":"published","published":"2019-12-31T16:53:35Z","modified":"2024-08-04T23:32:55Z","updated_at":"2026-11-03T02:40:44.884887Z"}],"ghsa":[{"id":"GHSA-84qr-xgvg-w6h2","title":"The Java API in Generalitat de Catalunya accesuniversitat.gencat.cat 1.7.5 allows remote...","description":"The Java API in Generalitat de Catalunya accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints, given that the attacker is authenticated as a student: 1) https://accesuniversitat.gencat.cat/accesuniversitat/accesuniversitat-rs/AppJava/api/v1/estudiants/{student_id}/ 2) https://accesuniversitat.gencat.cat/accesuniversitat/accesuniversitat-rs/AppJava/api/v1/estudiants/?page={page}.","status":"published","published":"2022-05-24T17:05:24Z","modified":"2024-04-04T02:46:13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-706"],"updated_at":"2026-11-02T14:56:11.559223Z"}],"nvd":[{"id":"CVE-2019-12837","description":"The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.","status":"published","published":"2019-12-31T17:15:10.647Z","modified":"2026-06-17T02:15:35.38Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-706","CWE-863"],"updated_at":"2026-11-02T14:05:41.313583Z"}]}}