Description
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSignLabs | OpenSign | ≤ 2.37.0 | — |