Description
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SecObserve | SecObserve | 1.17.0 – < 1.59.1 | 1.59.1 |
References
- GitHub Issue #4799 issue-tracking
- https://github.com/SecObserve/SecObserve product
- GitHub Security Advisory (GHSA-r968-78vw-jj9m) third-party-advisory vendor-advisory
- to_representation pops api_key but not basic_auth_password technical-description
- SecObserve v1.59.1 Release Notes release-notes
- VulnCheck Advisory: SecObserve before 1.59.1 Information Disclosure via API Configuration third-party-advisory