DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session.
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Emc_appsync | Dell | * | 4.4.0.0 (excluding) |