Description (CNA)
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSourceService.queryExistent(id, ...) without an ownership check and returns the decrypted password field, allowing any authenticated non-admin user to enumerate datasource IDs and read the plaintext database credentials of datasources owned by other users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OtterMind / Chat2DB | affected 0 before 5.3.0 |
CWE
CWE-639
References
- https://github.com/OtterMind/Chat2DB/issues/1839
- https://github.com/OtterMind/Chat2DB/releases/tag/v5.3.0
- https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository
ADP enrichment
No English description supplied.
No references supplied.