Kameleo
Monthly
Information disclosure in Kameleo through version 5.3.1 lets an unauthenticated remote attacker read data exposed by the /general/user-info endpoint of the Local API component, provided the victim is induced to perform an interaction that causes the request to be issued (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R, C:L only). Only low-confidentiality data is at risk - there is no integrity or availability impact - and the Local API must be active and reachable along the attacker's request path, which typically means a browser-mediated or cross-origin trigger against a normally localhost-bound service. No public exploit code was identified at time of analysis, and the vendor did not respond to the disclosure, so no vendor-released patch has been identified.
Information disclosure in the Local API of Kameleo (versions up to and including 5.0.1.26) lets a remote, unauthenticated attacker read data exposed by the /profiles endpoint, with the assessed CVSS 3.1 score of 5.3 reflecting confidentiality-only impact (C:L) and a required victim-side action (UI:R). Exploitation is opportunistic rather than mass-scale: Kameleo must be running with its Local API reachable along the attacker's request path, and the exact mechanism by which /profiles leaks data is not described in the available sources. The vendor addressed the issue in release 5.2.0, whose security note states that proxy passwords are now redacted in API responses; no confirmed active exploitation (CISA KEV) or verified public exploit code was identified at time of analysis, and the vulnerability is triaged as a plan-and-patch item rather than an emergency.
Information disclosure in Kameleo up to and including 5.3.1 allows remote attackers to read cookie data held by the client engine by manipulating the 'guid' argument passed to CookieController.ListCookies in client-engine-application/w.cs. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates no privileges are needed and the attack is network-reachable, but exploitation depends on passive user interaction, and impact is confined to low confidentiality with no integrity or availability effect. No vendor patch or fixed version is identified - the vendor was contacted and did not respond - and there is no CISA KEV entry or confirmed public exploit code; the references include an external Google Drive link whose contents are not characterized in the available data.
Kameleo through 5.0.1.26 can disclose profile information to a local, low-privileged user through the Profile Controller's ListProfiles function (CWE-200). The supplied CVSS 4.0 vector scores 4.8 (medium) with confidentiality-only impact; the vendor fixed it in 5.2.0, and the supplied intelligence does not confirm CISA KEV exploitation or working public exploit code.
Server-side request forgery in Kameleo's proxy-validation feature affects versions up to and including 5.0.1.26 and lets an authenticated low-privilege user who interacts with the proxy tester manipulate the host and port arguments of InternalController.TestProxy so the client-engine application issues requests to destinations of the attacker's choosing. The assessed impact is limited (CVSS 5.1; low confidentiality, integrity, and availability impact), and exploitation requires access to the Kameleo client-engine API plus passive user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; upgrading to 5.2.0 removes the vulnerable route.
Information disclosure in Kameleo through version 5.3.1 lets an unauthenticated remote attacker read data exposed by the /general/user-info endpoint of the Local API component, provided the victim is induced to perform an interaction that causes the request to be issued (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:R, C:L only). Only low-confidentiality data is at risk - there is no integrity or availability impact - and the Local API must be active and reachable along the attacker's request path, which typically means a browser-mediated or cross-origin trigger against a normally localhost-bound service. No public exploit code was identified at time of analysis, and the vendor did not respond to the disclosure, so no vendor-released patch has been identified.
Information disclosure in the Local API of Kameleo (versions up to and including 5.0.1.26) lets a remote, unauthenticated attacker read data exposed by the /profiles endpoint, with the assessed CVSS 3.1 score of 5.3 reflecting confidentiality-only impact (C:L) and a required victim-side action (UI:R). Exploitation is opportunistic rather than mass-scale: Kameleo must be running with its Local API reachable along the attacker's request path, and the exact mechanism by which /profiles leaks data is not described in the available sources. The vendor addressed the issue in release 5.2.0, whose security note states that proxy passwords are now redacted in API responses; no confirmed active exploitation (CISA KEV) or verified public exploit code was identified at time of analysis, and the vulnerability is triaged as a plan-and-patch item rather than an emergency.
Information disclosure in Kameleo up to and including 5.3.1 allows remote attackers to read cookie data held by the client engine by manipulating the 'guid' argument passed to CookieController.ListCookies in client-engine-application/w.cs. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates no privileges are needed and the attack is network-reachable, but exploitation depends on passive user interaction, and impact is confined to low confidentiality with no integrity or availability effect. No vendor patch or fixed version is identified - the vendor was contacted and did not respond - and there is no CISA KEV entry or confirmed public exploit code; the references include an external Google Drive link whose contents are not characterized in the available data.
Kameleo through 5.0.1.26 can disclose profile information to a local, low-privileged user through the Profile Controller's ListProfiles function (CWE-200). The supplied CVSS 4.0 vector scores 4.8 (medium) with confidentiality-only impact; the vendor fixed it in 5.2.0, and the supplied intelligence does not confirm CISA KEV exploitation or working public exploit code.
Server-side request forgery in Kameleo's proxy-validation feature affects versions up to and including 5.0.1.26 and lets an authenticated low-privilege user who interacts with the proxy tester manipulate the host and port arguments of InternalController.TestProxy so the client-engine application issues requests to destinations of the attacker's choosing. The assessed impact is limited (CVSS 5.1; low confidentiality, integrity, and availability impact), and exploitation requires access to the Kameleo client-engine API plus passive user interaction. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; upgrading to 5.2.0 removes the vulnerable route.