Vulnerability · Published Jul 21, 2022 · Assigned by INCD
CVE-2022-30628Supersmart.me – Walk Through access to business information without authentication
Medium 4.8
In plain English
A medium-severity security flaw in Supersmart.me – Walk Through from Supersmart.me. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 92.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Supersmart.me | Supersmart.me – Walk Through | Update to the latest version – before Update to the latest version* |
References
- https://www.gov.il/en/Departments/faq/cve_advisories x_refsource_MISC