Hubert Decyusz

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** Insufficient authorization enforcement in the '/customer/servlet/mco/webapi/profile-sections/group-membership' endpoint allows an authenticated user to modify their group membership. By providing a valid group ID, which may be obtained through the '/customer/servlet/mco/webapi/group/picker/groups' endpoint or via brute-force, an attacker can add themselves to arbitrary groups, leading to privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** An Insecure Direct Object Reference (IDOR) exists in the '/customer/servlet/mco/webapi/trading-document/fetchPdfStatement' endpoint. The application fails to properly validate if an authenticated user is authorized to access a specific document, allowing the retrieval of files based on a user-supplied identifier. An attacker can access trading documents of other users by providing a valid document ID. While this requires guessing the identifier, predictable ID patterns make enumeration feasible, potentially leading to the unauthorized disclosure of sensitive information. **Recommendations** For version 25.3.3.1, restrict access to the '/customer/servlet/mco/webapi/trading-document/fetchPdfStatement' endpoint to ensure users can only access their own documents. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** Account Denial of Service occurs due to the improper implementation of the password reset functionality. Each request to reset a password invalidates the current password and any previously issued temporary passwords. Since there are no limits on the number of reset requests, an attacker who knows the victim's email and the answer to their security question can continuously initiate the reset process to invalidate credentials and lock the user out of their account. The risk is partially mitigated by a limited number of attempts allowed when answering security questions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** Insufficient authorization enforcement occurs in the '/customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure' endpoint. This allows an authenticated user with low privileges to retrieve administrator access control structures, potentially exposing internal configuration details and sensitive permission mappings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** The software contains flaws in file handling functionality used for data export and upload. Improper validation of the `filename` parameter enables path traversal, allowing files to be written to arbitrary locations on the server. Additionally, the system is susceptible to path disclosure, where absolute server paths are indirectly revealed through error messages. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** The software is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs through the application logo upload functionality, allowing an attacker with permissions to change the logo to upload a crafted SVG file containing malicious JavaScript. The script executes when the logo is rendered or opened. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** The application is susceptible to user enumeration via authentication-related features. During password reset and username reminder operations, the system provides different responses depending on whether the user is valid or invalid. This behavior allows an attacker to identify and compile lists of valid usernames and email addresses. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCO version 25.3.3.1 **Description** The software fails to correctly validate the types of uploaded files because the validation process relies exclusively on client-side checks, which can be bypassed. This allows an authorized, low-privileged attacker to upload files of arbitrary types to the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.