DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session.
Weakness
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Emc_appsync | Dell | * | 4.4.0.0 (excluding) |