| Título | Omega Solution CoinEx Crypto latest Information Disclosure |
|---|
| Descripción | Omega Solution CoinEx Crypto 2025 contains an information disclosure vulnerability in the customer support ticket retrieval functionality. The application returns excessive customer account information when processing requests to the support ticket API and includes sensitive internal attributes that are unrelated to the intended functionality. Successful exploitation allows an authenticated user to obtain confidential account information, including bcrypt password hashes, internal user identifiers, role assignments, account status information, and other internal metadata through the API response. The unnecessary disclosure of sensitive authentication and account data increases the attack surface and may facilitate offline password cracking attempts, user enumeration, and further attacks against affected accounts.
Affected Component:
Support Ticket API
Affected Endpoint:
GET /ticket/customer
Affected Parameters:
status, page, count
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
OWASP Top 10 2021: A02 – Cryptographic Failures
OWASP API Security Top 10: API3 – Broken Object Property Level Authorization (Excessive Data Exposure) |
|---|
| Fuente | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/26 |
|---|
| Usuario | 4m3rr0r (UID 85795) |
|---|
| Sumisión | 2026-07-17 19:51 (hace 3 meses) |
|---|
| Moderación | 2026-10-03 11:43 (3 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 413347 [Omega Solution CoinEx Crypto 2025 Support Ticket API /ticket/customer status/page/count divulgación de información] |
|---|
| Puntos | 20 |
|---|