CWE-202
AllowedExposure of Sensitive Information Through Data Queries
Abstraction: Base · Status: Draft
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
69 vulnerabilities reference this CWE, most recent first.
GHSA-4QCP-WHVM-5MWC
Vulnerability from github – Published: 2023-08-04 00:30 – Updated: 2024-01-25 18:30A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.
This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
{
"affected": [],
"aliases": [
"CVE-2023-20215"
],
"database_specific": {
"cwe_ids": [
"CWE-202"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T22:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked.\n\n This vulnerability is due to improper detection of malicious traffic when the traffic is encoded with a specific content format. An attacker could exploit this vulnerability by using an affected device to connect to a malicious server and receiving crafted HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.",
"id": "GHSA-4qcp-whvm-5mwc",
"modified": "2024-01-25T18:30:37Z",
"published": "2023-08-04T00:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20215"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-vXvqwzsj"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-54JQ-C3M8-4M76
Vulnerability from github – Published: 2026-01-05 23:09 – Updated: 2026-01-06 16:06Summary
Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.
Impact
If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.
Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.13.2"
},
"package": {
"ecosystem": "PyPI",
"name": "aiohttp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-69226"
],
"database_specific": {
"cwe_ids": [
"CWE-202",
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-05T23:09:51Z",
"nvd_published_at": "2026-01-05T23:15:40Z",
"severity": "LOW"
},
"details": "### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e",
"id": "GHSA-54jq-c3m8-4m76",
"modified": "2026-01-06T16:06:47Z",
"published": "2026-01-05T23:09:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69226"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiohttp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "AIOHTTP vulnerable to brute-force leak of internal static \ufb01le path components"
}
GHSA-5G3W-62HR-P464
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2025-07-23 15:31A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be restricted. The attacker must have valid device credentials. This vulnerability is due to improper access controls on API endpoints. An attacker could exploit the vulnerability by sending a specific API request to an affected application. A successful exploit could allow the attacker to obtain sensitive information about other users who are configured with higher privileges on the application.
{
"affected": [],
"aliases": [
"CVE-2021-34782"
],
"database_specific": {
"cwe_ids": [
"CWE-202"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-06T20:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be restricted. The attacker must have valid device credentials. This vulnerability is due to improper access controls on API endpoints. An attacker could exploit the vulnerability by sending a specific API request to an affected application. A successful exploit could allow the attacker to obtain sensitive information about other users who are configured with higher privileges on the application.",
"id": "GHSA-5g3w-62hr-p464",
"modified": "2025-07-23T15:31:07Z",
"published": "2022-05-24T19:16:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34782"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-infodisc-KyC6YncS"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6497-PRX7-GPMQ
Vulnerability from github – Published: 2026-01-30 21:30 – Updated: 2026-06-05 17:56SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "geopandas"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-69662"
],
"database_specific": {
"cwe_ids": [
"CWE-202",
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-01T18:09:10Z",
"nvd_published_at": "2026-01-30T19:16:11Z",
"severity": "HIGH"
},
"details": "SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.",
"id": "GHSA-6497-prx7-gpmq",
"modified": "2026-06-05T17:56:23Z",
"published": "2026-01-30T21:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69662"
},
{
"type": "WEB",
"url": "https://github.com/geopandas/geopandas/issues/3679"
},
{
"type": "WEB",
"url": "https://github.com/geopandas/geopandas/pull/3681"
},
{
"type": "WEB",
"url": "https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419"
},
{
"type": "WEB",
"url": "https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas"
},
{
"type": "PACKAGE",
"url": "https://github.com/geopandas/geopandas"
},
{
"type": "WEB",
"url": "https://github.com/geopandas/geopandas/releases/tag/v1.1.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure"
}
GHSA-6636-XFJ2-VP52
Vulnerability from github – Published: 2023-02-12 09:30 – Updated: 2023-02-21 21:30A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file check_availability.php. The manipulation of the argument username leads to exposure of sensitive information through data queries. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220645 was assigned to this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-0785"
],
"database_specific": {
"cwe_ids": [
"CWE-202"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-12T08:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file check_availability.php. The manipulation of the argument username leads to exposure of sensitive information through data queries. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-220645 was assigned to this vulnerability.",
"id": "GHSA-6636-xfj2-vp52",
"modified": "2023-02-21T21:30:16Z",
"published": "2023-02-12T09:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0785"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.220645"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.220645"
},
{
"type": "WEB",
"url": "https://youtu.be/n_BfBlsUIN8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6F65-4FV2-WWCH
Vulnerability from github – Published: 2026-01-30 19:35 – Updated: 2026-01-30 19:35Summary
The NativeAuthenticationStrategy.authenticate() method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses).
Details
In packages/core/src/config/auth/native-authentication-strategy.ts, the authenticate method returns immediately if a user is not found:
const user = await this.userService.getUserByEmailAddress(ctx, data.username);
if (!user) {
return false; // Instant return (~1-5ms)
}
const passwordMatch = await this.verifyUserPassword(ctx, user.id, data.password);
// Password check takes ~200-400ms with bcrypt (12 rounds)
The significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts.
Impact
- Attackers can enumerate valid user accounts
- Enables targeted brute-force or phishing attacks
- Information disclosure (account existence)
Recommended Fix
Perform a dummy bcrypt check when user is not found to ensure consistent response times.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@vendure/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25050"
],
"database_specific": {
"cwe_ids": [
"CWE-202"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-30T19:35:40Z",
"nvd_published_at": "2026-01-30T16:16:13Z",
"severity": "LOW"
},
"details": "### Summary\nThe `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses).\n\n### Details\nIn `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate method returns immediately if a user is not found:\n\n```typescript\nconst user = await this.userService.getUserByEmailAddress(ctx, data.username);\nif (!user) {\n return false; // Instant return (~1-5ms)\n}\nconst passwordMatch = await this.verifyUserPassword(ctx, user.id, data.password);\n// Password check takes ~200-400ms with bcrypt (12 rounds)\n```\n\nThe significant timing difference (~200-400ms for bcrypt vs ~1-5ms for DB miss) allows attackers to reliably distinguish between existing and non-existing accounts.\n\n### Impact\n- Attackers can enumerate valid user accounts\n- Enables targeted brute-force or phishing attacks\n- Information disclosure (account existence)\n\n### Recommended Fix\nPerform a dummy bcrypt check when user is not found to ensure consistent response times.",
"id": "GHSA-6f65-4fv2-wwch",
"modified": "2026-01-30T19:35:40Z",
"published": "2026-01-30T19:35:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-6f65-4fv2-wwch"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25050"
},
{
"type": "WEB",
"url": "https://github.com/vendurehq/vendure/commit/7f0c5556ecddb44a5d5208677a45fdd5923b0cc9"
},
{
"type": "PACKAGE",
"url": "https://github.com/vendurehq/vendure"
},
{
"type": "WEB",
"url": "https://github.com/vendurehq/vendure/releases/tag/v3.5.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy"
}
GHSA-784Q-2FW8-CPW8
Vulnerability from github – Published: 2024-05-22 09:31 – Updated: 2024-05-22 09:31The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 via the 'nxs_getExpSettings' function. This makes it possible for authenticated attackers, with subscriber access and above, to extract sensitive data including social network API keys and secrets.
{
"affected": [],
"aliases": [
"CVE-2024-2088"
],
"database_specific": {
"cwe_ids": [
"CWE-202"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T07:15:12Z",
"severity": "HIGH"
},
"details": "The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 via the \u0027nxs_getExpSettings\u0027 function. This makes it possible for authenticated attackers, with subscriber access and above, to extract sensitive data including social network API keys and secrets.",
"id": "GHSA-784q-2fw8-cpw8",
"modified": "2024-05-22T09:31:46Z",
"published": "2024-05-22T09:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2088"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/inc/nxs_functions_wp.php#L620"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3084635/social-networks-auto-poster-facebook-twitter-g/trunk/inc/nxs_functions_wp.php?contextall=1"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/70724bc7-c1f4-4965-8bba-99b2ed21d34b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-79HX-3FP8-HJ66
Vulnerability from github – Published: 2025-09-17 20:11 – Updated: 2025-09-26 16:18Impact
A peer exposes the gRPC API and HTTP API for consumption by other peers. These APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.
file, err := os.OpenFile(t.DataFilePath, os.O_RDWR, defaultFileMode)
if err != nil {
return 0, err
}
defer file.Close()
if _, err = file.Seek(req.Range.Start, io.SeekStart); err != nil {
return 0, err
}
n, err := io.Copy(file, io.LimitReader(req.Reader, req.Range.Length))
Patches
- Dragonfy v2.1.0 and above.
Workarounds
There are no effective workarounds, beyond upgrading.
References
A third party security audit was performed by Trail of Bits, you can see the full report.
If you have any questions or comments about this advisory, please email us at dragonfly-maintainers@googlegroups.com.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/dragonflyoss/dragonfly"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "d7y.io/dragonfly/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59352"
],
"database_specific": {
"cwe_ids": [
"CWE-202",
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-17T20:11:13Z",
"nvd_published_at": "2025-09-17T20:15:37Z",
"severity": "MODERATE"
},
"details": "### Impact\nA peer exposes the gRPC API and HTTP API for consumption by other peers. These APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers\u2019 secret data and to gain remote code execution (RCE) capabilities on the peer\u2019s machine.\n\n```golang\nfile, err := os.OpenFile(t.DataFilePath, os.O_RDWR, defaultFileMode)\nif err != nil {\n return 0, err\n}\ndefer file.Close()\nif _, err = file.Seek(req.Range.Start, io.SeekStart); err != nil {\n return 0, err\n}\nn, err := io.Copy(file, io.LimitReader(req.Reader, req.Range.Length))\n```\n\n### Patches\n\n- Dragonfy v2.1.0 and above.\n\n### Workarounds\n\nThere are no effective workarounds, beyond upgrading.\n\n### References\n\nA third party security audit was performed by Trail of Bits, you can see the [full report](https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf).\n\nIf you have any questions or comments about this advisory, please email us at [dragonfly-maintainers@googlegroups.com](mailto:dragonfly-maintainers@googlegroups.com).",
"id": "GHSA-79hx-3fp8-hj66",
"modified": "2025-09-26T16:18:51Z",
"published": "2025-09-17T20:11:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-79hx-3fp8-hj66"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59352"
},
{
"type": "PACKAGE",
"url": "https://github.com/dragonflyoss/dragonfly"
},
{
"type": "WEB",
"url": "https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3961"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P",
"type": "CVSS_V4"
}
],
"summary": "DragonFly vulnerable to arbitrary file read and write on a peer machine"
}
GHSA-7M85-P686-23RM
Vulnerability from github – Published: 2026-03-21 06:30 – Updated: 2026-03-21 06:30The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can('manage_options')) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder_control table and returns it along with all subaccount data as a JSON response. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the e-shot API token and subaccount information, which could then be used to access the victim's e-shot platform account.
{
"affected": [],
"aliases": [
"CVE-2026-3546"
],
"database_specific": {
"cwe_ids": [
"CWE-202"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-21T04:17:27Z",
"severity": "MODERATE"
},
"details": "The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can(\u0027manage_options\u0027)) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder_control table and returns it along with all subaccount data as a JSON response. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the e-shot API token and subaccount information, which could then be used to access the victim\u0027s e-shot platform account.",
"id": "GHSA-7m85-p686-23rm",
"modified": "2026-03-21T06:30:25Z",
"published": "2026-03-21T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3546"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/admin/class-eshotformbuilder-admin.php#L567"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/e-shot-form-builder/tags/1.0.2/includes/class-eshotformbuilder.php#L163"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/admin/class-eshotformbuilder-admin.php#L567"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/e-shot-form-builder/trunk/includes/class-eshotformbuilder.php#L163"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/965bb642-4472-491f-8378-f4331ba4ab7c?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-82GM-Q2VC-G3X3
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-05-14 00:01A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected system. This vulnerability is due to insufficient API authorization checking on the underlying operating system. An attacker could exploit this vulnerability by sending a crafted API request to Cisco vManage as a lower-privileged user and gaining access to sensitive information that they would not normally be authorized to access.
{
"affected": [],
"aliases": [
"CVE-2022-20747"
],
"database_specific": {
"cwe_ids": [
"CWE-202"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T15:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected system. This vulnerability is due to insufficient API authorization checking on the underlying operating system. An attacker could exploit this vulnerability by sending a crafted API request to Cisco vManage as a lower-privileged user and gaining access to sensitive information that they would not normally be authorized to access.",
"id": "GHSA-82gm-q2vc-g3x3",
"modified": "2022-05-14T00:01:19Z",
"published": "2022-04-16T00:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20747"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-infodis-73sHJNEq"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
This is a complex topic. See the [REF-1492] for a good discussion of best practices.
No CAPEC attack patterns related to this CWE.