CyberRota Analysis
AI-GeneratedThe vulnerability exists in Hiperdino’s REST v1.0 API, specifically in the public endpoint ‘customer/check,’ which lacks adequate access controls. This allows an authenticated attacker with a static bearer token to enumerate sensitive information, such as email addresses and telephone numbers, of registered customers without proper authentication or rate limiting. Organizations utilizing this API should prioritize remediation to prevent potential information disclosure and protect user privacy.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling. Successful exploitation of this vulnerability could allow a remote attacker to enumerate a user’s contact details, although this would require obtaining a valid static bearer token, constituting an information disclosure vulnerability.