CVE-2026-92759
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Fraqueza
SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.
Referências
- https://github.com/SecObserve/SecObserve
- https://github.com/SecObserve/SecObserve/blob/v1.54.0/backend/application/import_observations/api/serializers.py#L103-L119
- https://github.com/SecObserve/SecObserve/issues/4799
- https://github.com/SecObserve/SecObserve/releases/tag/v1.59.1
- https://github.com/SecObserve/SecObserve/security/advisories/GHSA-r968-78vw-jj9m
- https://www.vulncheck.com/advisories/secobserve-before-1.59.1-information-disclosure-via-api-configuration
Encontre a falha antes de um atacante.
Entre com o GitHub e rode sua primeira auditoria em menos de um minuto. O plano gratuito não exige cartão de crédito.