| शीर्षक | TSI Coop TSI DPDP CMS 0.4.8 Missing Authentication |
|---|
| विवरण | TSI DPDP CMS serves all 17 administrator and Data Protection Officer (DPO) console pages over HTTP without requiring any authentication. Any unauthenticated HTTP client can retrieve the full source code of every console page by sending a plain GET request — no credentials, session token, or API key required.
The application does not enforce any server-side authentication check before serving HTML and JavaScript files from the /console/ path hierarchy. Authentication logic exists only as client-side JavaScript that reads a token from localStorage and redirects the browser if absent — a control that is trivially bypassed by any HTTP client that is not a browser (e.g., curl, wget, scripted HTTP requests). |
|---|
| स्रोत | ⚠️ https://github.com/mano257200/TSI-DPDP-CMS-Missing-Authentication/blob/main/README.md |
|---|
| उपयोगकर्ता | Mahendravarman (UID 80955) |
|---|
| सबमिशन | 10/07/2026 07:18 PM (2 महीनों पहले) |
|---|
| संयम | 02/09/2026 01:57 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 398081 [tsi-coop tsi-dpdp-cms तक 0.5.0 Admin Console/DPO Compliance Console web.xml कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|