CyberRota Analysis
AI-GeneratedOpenSignLabs OpenSign versions up to 2.37.0 are vulnerable to an information disclosure flaw that allows unauthenticated remote attackers to map email addresses or usernames to their internal user object IDs through the getUserId Parse cloud function, which lacks proper authentication. This vulnerability can lead to user account enumeration, potentially facilitating further targeted attacks. Organizations using this software should prioritize remediation to protect user data and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.