CVE-2018-15656 Information
Feb 14, 2021
cve
Description
An issue was discovered in the registration API endpoint in 42Gears SureMDM before 2018-11-27. An attacker can submit a GET request to /api/register/:email where :email is a base64 encoded e-mail address to receive confirmation as to whether a user account exists in the system with the specified e-mail address. The request must be made with an \apiKey\ value in the \ApiKey\ header.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Reference
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
NONE
Base Severity
7.5
Share on: