| عنوان | Eleveo Call Recording Software 10.3.0 CWE-598 |
|---|
| الوصف | Eleveo Call Recording Software 10.3.0 transmits the user's JWT as a URL query string parameter during the logout GET request. This exposes the token in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party services.
Evidence:
--- Logout Request ---
GET /auth/realms/default/protocol/openid-connect/logout?client_id=encourage-js-client&post_logout_redirect_uri=https%3A%
2F%2F[HOST]%2Fapp%2Fconversations%2Fconversations&id_token_hint=[MASKED TOKEN] HTTP/1.1
Host: [HOST]
Cookie: KEYCLOAK_LOCALE=en-US; AUTH_SESSION_ID=[MASKED]
Referer: https://[HOST]/app/conversations/conversations
Priority: u=0, i
Connection: keep-alive
--- Logout Response ---
HTTP/1.1 302
Date: Fri, 28 Aug 2026 15:14:40 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive |
|---|
| المستخدم | ozataknurullah (UID 101077) |
|---|
| ارسال | 07/09/2026 04:14 PM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 11:57 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416585 [Eleveo Call Recording Software حتى 10.3.0 JWT Token logout id_token_hint الكشف عن المعلومات] |
|---|
| النقاط | 17 |
|---|