The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.
Weakness
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Portal_d’acces_a_la_universitat | Gencat | 1.7.5 (including) | 1.7.5 (including) |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/159.html
- https://cwe.mitre.org/data/definitions/177.html
- https://cwe.mitre.org/data/definitions/48.html
- https://cwe.mitre.org/data/definitions/641.html