Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- CVE-2024-40395
- Description:
- An Authenticated Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0
- allows attackers to view sensitive information, including PII, regardless of access level.
- This allows any user to get data of vehicles, drivers, users and other information of all organizations of the vulnerable system using PTC ThingWorx v9.5.0 instead of the normally allowed view of his own organization.
- The IDOR is possible by altering the Organization name parameter in the HTTP requests, which will make the corresponding data to show in the HTTP response.
- ------------------------------------------
- Vulnerability Type:
- Authenticated Insecure Direct Object Reference (IDOR)
- ------------------------------------------
- Vendor of Product and Version:
- PTC ThingWorx - Thingworx Platform version 9.5.0
- ------------------------------------------
- Affected Endpoints:
- - POST /Thingworx/Things/PostgreSQLNew/Services/VehicleProfile_NewV5?
- - POST /Thingworx/Things/PostgreSQL/Services/Driver_Pages_New_V3?
- - POST /Thingworx/Things/UsersThing/Services/GetUsersByOrganizationMultiQ?
- ------------------------------------------
- Impact: Information Disclosure
- ------------------------------------------
- Attack Vectors:
- Compromised Credentials.
- ------------------------------------------
- Discoverer:
- Abdulazeiz Rashed Aldhanhani
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
