CVE-2019-11019

Name of the Vulnerable Software and Affected Versions DDRT Dashcom Live versions prior to 2019-05-08

Description The issue is related to a lack of authentication in case-exporting components, allowing unauthorized access to claim details. By visiting easily guessable URLs, such as "exportpdf/all claim detail.php?claim id=" with a claim id variable, an attacker can remotely access all claim details.

Recommendations For versions prior to 2019-05-08, as a temporary workaround, consider restricting access to the "exportpdf/all claim detail.php" endpoint until a patch is available. Avoid using the claim id variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.