CyberRota Analysis
AI-GeneratedR-SOFT DMS is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability across multiple file download endpoints, allowing any authenticated user to access files from the database by simply manipulating the file ID. This could lead to unauthorized data exposure, potentially compromising sensitive information. Organizations using affected versions should prioritize upgrading to versions v3.19-2862 or v3.17-2580 to mitigate this risk.
Original NVD Description
R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This issue was fixed in version v3.19-2862 and v3.17-2580.