Description (CNA)
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenSignLabs / OpenSign | affected 0 through 2.37.0 |
CWE
CWE-200
References
ADP enrichment
No English description supplied.
No references supplied.