Description (CNA)
OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Openpanel-dev / openpanel | affected 0 through 2.3.0 |
CWE
CWE-200
References
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-7gv7-c464-9wh8
- https://github.com/Openpanel-dev/openpanel/commit/5faad3226df8fe03bc9434dfd255afb3fcea4c83
- https://www.vulncheck.com/advisories/openpanel-unauthenticated-share-lookup-information-disclosure
ADP enrichment
No English description supplied.
No references supplied.