CyberRota Analysis
AI-GeneratedOpenSignLabs OpenSign versions up to 2.37.0 are vulnerable due to an insecure direct object reference, allowing unauthenticated remote attackers to access any contact record through the getcontact Parse cloud function. This vulnerability enables attackers to enumerate and retrieve sensitive personally identifiable information without any authentication or authorization checks. Organizations using this software should prioritize remediation to protect against potential data breaches and unauthorized access to sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.