CVE-2023-24471CWE-863

Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2

High · published August 9, 2023

CVSS v4.0
7.1
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.

An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-08-09T08:54Z
EPSS history
Timeline
  • 09 AUG 08:54Z
    Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2
    cvelistv5