PT-2020-10302
CVE-2019-19946
·
Published
2020-03-16
·
Updated
2021-07-21
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Dradis Pro version 3.4.1
Description
The issue allows any user to extract the content of a project, even if the user is not part of the project team, through the API.
Recommendations
For Dradis Pro version 3.4.1, consider restricting access to the API to prevent unauthorized project content extraction until a patch is available.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾