Description
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SecObserve SecObserve
Default version status: unaffected
1.17.0 to < 1.59.1affected
References
- https://github.com/SecObserve/SecObserve/issues/4799 ↗
- https://github.com/SecObserve/SecObserve ↗
- https://github.com/SecObserve/SecObserve/security/advisories/GHSA-r968-78vw-jj9m ↗
- https://github.com/SecObserve/SecObserve/blob/v1.54.0/backend/application/import_observations/api/serializers.py#L103-L119 ↗
- https://github.com/SecObserve/SecObserve/releases/tag/v1.59.1 ↗
- https://www.vulncheck.com/advisories/secobserve-before-1.59.1-information-disclosure-via-api-configuration ↗