Security Configuration API Information Exposure in Axxon One

Executive Summary

This vulnerability is an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in AxxonSoft Axxon One before version 3.2.0. A remote authenticated user with limited privileges can exploit the security configuration API to enumerate all user accounts and roles configured in the system via a user configuration request. The system returns the complete lists of users and roles regardless of the caller's permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the security configuration API in AxxonSoft Axxon One versions before 3.2.0 returns user account and role information without proper permission validation. Monitor API responses for unauthorized enumeration of users and roles.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with limited access to gain unauthorized knowledge of all user accounts and roles in the system. This could lead to further attacks such as privilege escalation, unauthorized access to sensitive data, or targeted phishing attempts against specific users.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade AxxonSoft Axxon One to version 3.2.0 or later to address the exposure of sensitive information. Ensure proper access controls are enforced in the security configuration API to prevent unauthorized enumeration of user accounts and roles.

Useful 0 Not Useful 0