Popis
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) expose sensitive account information through the -update-profile/- API endpoint. A remote, unauthenticated attacker can submit a request containing an arbitrary -user_id- parameter and receive a JSON response containing account-specific information, including the associated email address.
CVSS 5.3EPSS 0.505%Riziko 0.55
Zobraziť zdroj- Zverejnené
- 2026-06-18 17:16:33
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N