Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.
oryginał ENCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XRallly
APPRallly< 4.5.6
Powiązane podatności
IDOR w Rallly — nieautoryzowane finalizowanie ankiet innych użytkowników
Rallly – brute force tokenu logowania umożliwia przejęcie konta
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization ...
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object ...
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in t...