| タイトル | Omega Solution CoinEx Crypto latest Information Disclosure |
|---|
| 説明 | Omega Solution CoinEx Crypto 2025 contains an information disclosure vulnerability in the customer support ticket retrieval functionality. The application returns excessive customer account information when processing requests to the support ticket API and includes sensitive internal attributes that are unrelated to the intended functionality. Successful exploitation allows an authenticated user to obtain confidential account information, including bcrypt password hashes, internal user identifiers, role assignments, account status information, and other internal metadata through the API response. The unnecessary disclosure of sensitive authentication and account data increases the attack surface and may facilitate offline password cracking attempts, user enumeration, and further attacks against affected accounts.
Affected Component:
Support Ticket API
Affected Endpoint:
GET /ticket/customer
Affected Parameters:
status, page, count
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
OWASP Top 10 2021: A02 – Cryptographic Failures
OWASP API Security Top 10: API3 – Broken Object Property Level Authorization (Excessive Data Exposure) |
|---|
| ソース | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/26 |
|---|
| ユーザー | 4m3rr0r (UID 85795) |
|---|
| 送信 | 2026年07月17日 19:51 (3 月 ago) |
|---|
| モデレーション | 2026年10月03日 11:43 (3 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413347 [Omega Solution CoinEx Crypto 2025 Support Ticket API /ticket/customer status/page/count 情報漏えい] |
|---|
| ポイント | 20 |
|---|