CyberRota Analysis
AI-GeneratedThe vulnerability exists in the public.transfer_app RPC function of Cap-go versions prior to 12.128.2, allowing unauthenticated attackers to exploit distinct error messages to enumerate valid app IDs. This information disclosure could lead to further attacks, as attackers can identify valid application identifiers within the system. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid app IDs by observing error message differences when calling transfer_app with only the publishable API key.