CVE-2023-49112

Medium

Description

Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so. This issue affects Kiuwan SAST: <master.1808.p685.q13371

SeverityMedium

CVSS6.5

Exploit probability—

ProductSAST

PublishedJun 20, 2024

First seenJun 20, 2024

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Vendor advisories

kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log

Affected products

Product	Affected versions	Fixed in
Kiuwan SAST	<master.1808.p685.q13371	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.