Compliance Impact

This vulnerability involves the exposure of OTPs in plaintext within API responses, which could allow unauthorized access to user accounts through interception.

Such unauthorized access and exposure of sensitive authentication data could lead to non-compliance with common data protection standards and regulations like GDPR and HIPAA, which require protection of personal and authentication data to ensure user privacy and security.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the e-Sushrut system because one-time passwords (OTPs) are exposed in plaintext within API responses.

A remote attacker can exploit this by intercepting these API responses to obtain valid OTPs.

Useful 0 Not Useful 0

Impact Analysis

If exploited successfully, an attacker could impersonate the targeted user.

This would allow unauthorized access to user accounts on the affected system.

Useful 0 Not Useful 0

Impact Analysis

If exploited successfully, an attacker could impersonate the targeted user.

This would allow unauthorized access to user accounts on the affected system.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the e-Sushrut system because one-time passwords (OTPs) are exposed in plaintext within API responses.

A remote attacker can exploit this by intercepting these API responses that contain valid OTPs.

Useful 0 Not Useful 0