CyberRota Analysis
AI-GeneratedTestLink versions 1.9.20 and earlier are vulnerable to an insecure direct object reference that enables authenticated users, including low-privilege guests, to access arbitrary attachments by manipulating the attachment ID in the download handler. This flaw allows attackers to bypass project-specific access controls, leading to potential exposure of sensitive documents across private projects. Organizations using these versions should prioritize remediation to protect sensitive data from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role authorization check. Attackers can enumerate sequential integer IDs through the attachment download endpoint to retrieve file contents from private projects they have no membership in, bypassing the per-project access control model and exposing test specifications, requirements documents, execution evidence, and other sensitive uploaded files across the entire installation.