CyberRota Analysis
AI-GeneratedThe SmartAdmin API in Java 17 with Spring Boot 3 version 3.30.0 is vulnerable due to improper authorization in the /employee/queryAll endpoint, which fails to enforce necessary function-level permissions. This allows authenticated low-privileged users to access sensitive employee records from other departments, potentially leading to unauthorized data exposure. Organizations using this version should prioritize remediation to protect sensitive employee information and maintain compliance with data protection regulations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users