CyberRota Analysis
AI-GeneratedOpenSignLabs OpenSign versions up to 2.37.0 are vulnerable to an information disclosure flaw that permits unauthenticated remote attackers to access any organization's tenant record through the gettenant Parse cloud function. This vulnerability allows attackers to enumerate and extract sensitive tenant configuration data without any authentication or authorization checks. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.