Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component autumn-cms/user/getAllUser/?page=1&limit=10.
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Autumn | Autumn_project | * | 1.0.4 (including) |