The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to…
The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Zenitel
- Product
- Zenitel Connect
- CVSS v4.0
- 6.9 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-540
- NVD status
- Received
Why it ranks 18 (Routine)
- CVSS v4.0 6.9 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.