| शीर्षक | Omega Solution ERP OS latest Information Disclosure |
|---|
| विवरण | Omega Solution ERP OS 2025 contains an information disclosure vulnerability in the role permission retrieval functionality. The application exposes Role-Based Access Control (RBAC) permission assignments through an API endpoint without enforcing authentication or authorization. By supplying an arbitrary role identifier, a remote attacker can enumerate permission sets associated with privileged and non-privileged roles, disclosing the application's internal authorization model, administrative capabilities, and permission hierarchy. Successful exploitation allows unauthenticated access to sensitive authorization metadata that may facilitate reconnaissance and subsequent attacks against the application.
Affected Component:
Role Permission API
Affected Endpoint:
GET /role-permission/permission
Affected Parameter:
roleId
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-306: Missing Authentication for Critical Function
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control
OWASP API Security Top 10: API9 – Improper Inventory Management |
|---|
| स्रोत | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/28 |
|---|
| उपयोगकर्ता | 4m3rr0r (UID 85795) |
|---|
| सबमिशन | 17/07/2026 07:53 PM (3 महीनों पहले) |
|---|
| संयम | 03/10/2026 11:43 AM (3 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 408065 [Omega Solution HRM OS तक 20260717 Role Permission API permission roleId कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|