Description (CNA)
Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| mersive / Solstice Pod API | affected 5.5; affected 6.2 |
CWE
CWE-319
References
- https://www.exploit-db.com/exploits/52104
- https://www.mersive.com/
- https://documentation.mersive.com/en/solstice/about-solstice.html
- https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpoint
ADP enrichment
No English description supplied.