CyberRota Analysis
AI-GeneratedAuthenticated members of Ops Manager can exploit user-listing endpoints to access another member's pending authenticator enrollment seed when their enrollment is unconfirmed. This vulnerability may lead to the unauthorized disclosure of sensitive authentication information, potentially compromising account security within the organization. Organizations utilizing Ops Manager should prioritize addressing this issue to safeguard their members' authentication processes.
Original NVD Description
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Related CVEs
Other vulnerabilities affecting the same vendor(s)