CVE-2022-24189

The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly

Medium · published November 28, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
44.1
In the wild
Unconfirmed
What it is

The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other users unique identifiers and enumerate information of all other end-users.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00532 · 44.1th percentile
Published
2022-11-28T00:00Z
EPSS history
Timeline
  • 28 NOV 00:00Z
    The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly
    cvelistv5