CWE-612: Improper Authorization of Index Containing Sensitive Information
The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.
A kind of CWE-1230 Exposure of Sensitive Information Through Metadata.
From the CWE List. © The MITRE Corporation.
Newest
- play equitypandit EquityPandit 1.0 Insecure Logging Information Disclosure 8.7 High
- petlibrio smart pet feeder platform, petlibro +1 more Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint 6.9 Medium
- petlibrio smart pet feeder platform, petlibro +1 more Petlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint 6.9 Medium
- petlibrio smart pet feeder platform, petlibro +1 more Petlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint 6.9 Medium
- contao Contao discloses sensitive information in the front end search index 5.3 Medium
- microsoft defender for endpoint, defender for endpoint for windows +1 more Windows Defender Information Disclosure Vulnerability 6.5 Medium
- alf, alfio-event alf.io +1 more IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS 8.8 High
- omeka omeka/omeka-s, s +1 more Improper Authorization of Index Containing Sensitive Information in omeka/omeka-s 6.5 Medium
- alf, alfio-event alfio-event/alf.io +1 more Authorization Bypass Through User-Controlled Key in alfio-event/alf.io 8.8 High
- amazon opensearch, embysupport security +1 more Issue with fine-grained access control of indices backing data streams 6.3 Medium
- amazon opensearch, embysupport security +1 more OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information 7.5 High
- dell powerscale onefs, emc powerscale onefs +1 more Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index... 4.7 Medium