Unauthenticated API Exposure in Tenable Identity Exposure

Executive Summary

This vulnerability in Tenable Identity Exposure involves multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data. This data includes cleartext LDAP credentials, SAML configuration, user accounts, and directory settings. Because these endpoints do not require authentication, remote attackers can access this sensitive information without any credentials.

Additionally, the affected responses are served with Cache-Control: public headers and lack the Vary: Cookie header. This allows reverse proxies and content delivery networks (CDNs) to cache and serve this sensitive data to unauthenticated users even after authentication is applied.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive configuration data such as LDAP credentials and user account information. Attackers can exploit this to gain further unauthorized access or perform malicious actions within the affected environment.

Because the sensitive data can be cached and served by reverse proxies or CDNs to unauthenticated users, the exposure risk is increased and may persist even after authentication controls are applied.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes sensitive application configuration data, including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Such exposure of sensitive data can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information.

Additionally, the fact that affected responses are cached publicly by reverse proxies and CDNs increases the risk of unauthorized data disclosure, further impacting compliance with data protection and privacy regulations.

Useful 0 Not Useful 0