Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable…
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- TPC Software
- Product
- Matchpoint
- CVSS v4.0
- 8.7 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-306
- NVD status
- Deferred
Why it ranks 25 (Notable)
- CVSS v4.0 8.7 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.