Description
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SOUND4 | Impact/Pulse/First | Version 2: 1.1/2.15 | — |
| SOUND4 | Impact/Pulse Eco | 1.16 | — |
| SOUND4 | BigVoice4 | 1.2 | — |
| SOUND4 | BigVoice2 | 1.30 | — |
| SOUND4 | Stream | 1.1/2.4.29 | — |
| Kantar Media | WM2 | 1.11 | — |
References
- ExploitDB-51169 exploit
- SOUND4 Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2022-5723) third-party-advisory
- VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References third-party-advisory