A blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access control which leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security.
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
Updated vendor and product information, changed severity to HIGH, and noted that the vulnerability is actively exploited.
Initial creation
