OvalEdge Sensitive Data Exposure Vulnerabilities (CVE-2022-30361/30354/30359)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Types: - Sensitive Data Exposure (Unauthenticated): CVE-2022-30361 - Sensitive Data Exposure (Authenticated): CVE-2022-30354 - Sensitive Data Exposure (Unauthenticated): CVE-2022-30359 2. Affected Versions: - OvalEdge 5.2.8.0 and earlier versions 3. Vulnerability Description: - Unauthenticated Sensitive Data Exposure: Accessing via a GET request without authentication allows retrieval of user information, including user ID, status, email address, role, user type, license type, and personal details. - Authenticated Sensitive Data Exposure: Accessing via a GET request requires authentication, but still exposes login credentials for all registered users. 4. Example Outputs: - Unauthenticated Sensitive Data Exposure: Example output shows user information retrieved via GET request, including user ID, password, name, email address, etc. - Authenticated Sensitive Data Exposure: Example output shows login credentials for all registered users retrieved via GET request. 5. Vulnerability Links: - Unauthenticated Sensitive Data Exposure: - Authenticated Sensitive Data Exposure: - Unauthenticated Sensitive Data Exposure: This information helps security teams understand the nature of the vulnerability, the affected scope, and how these vulnerabilities can be exploited.

Goal Reached Thanks to every supporter — we hit 100%!

OvalEdge Sensitive Data Exposure Vulnerabilities (CVE-2022-30361/30354/30359)