CVE-2023-38751
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
CVE-2023-38751 describes an improper authorization vulnerability in versions 4.4.0 to 4.7.7 of the Special Interest Group Network for Analysis and Liaison, allowing authorized API users to view organization information set as 'non-disclosure' in the information provision operation.
Risk Assessment
The risk to the organization involves the potential exposure of confidential information about organizations that should remain undisclosed, which could lead to breaches of privacy and trust.
Recommendation
It is recommended to upgrade to the latest version of the software to mitigate this vulnerability and to review the authorization policies for API users.
Original NVD description (English source)
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the organization information of the information receiver that is set as "non-disclosure" in the information provision operation.