CVE-2023-50872 - The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates and their respective holder

Back Back to CVE browser

HIGH

The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates and their respective holder

Published Apr 16, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.36%

Description

The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates and their respective holder. NOTE: the excellium-services.com web page about this issue mentions "Vendor says that it's not a security issue."

Affected products

Vendor Accredible Credential.net Product Accredible Credential.net Default
n/a
- Version
  december_6_2023
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Accredible Credential.net

n/a

Version	Status	Constraints
december_6_2023	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

Link	Providers	Tags
https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-50872
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-55605		Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2023-50872
https://help.accredible.com/accredible-product-release-notes