CVE-2023-50872

Published: Apr 16, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates and their respective holder. NOTE: the excellium-services.com web page about this issue mentions "Vendor says that it's not a security issue."

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (5)

https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-50872

Source: cve@mitre.org

https://excellium-services.com/cert-xlm-advisory/CVE-2023-50872

Source: cve@mitre.org

https://help.accredible.com/accredible-product-release-notes

Source: cve@mitre.org

https://excellium-services.com/cert-xlm-advisory/CVE-2023-50872

Source: af854a3a-2127-422b-91ae-364da2661108

https://help.accredible.com/accredible-product-release-notes

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.