Outsystems
Monthly
Authorization bypass in OutSystems Lifetime allows any authenticated platform user to read Change Logs for applications they are not authorized to access by manipulating the ApplicationID parameter - a classic IDOR exposing audit trails, user action histories, and application names across the management plane. All Lifetime versions prior to 11.28.2.3955 are affected, as confirmed by CERT-PL and the OutSystems vendor advisory. No public exploit code has been identified and EPSS exploitation probability is 0.04% (12th percentile), but the flaw is a meaningful control failure in environments that rely on role-segregated application visibility within Lifetime.
OutSystems Platform Server version 11.18.1.37828 is reported to allow denial of service through HTTP request smuggling (CWE-444) by sending a crafted HTTP request where the Content-Length header value does not match the actual body length, disrupting the server's HTTP parser and causing service unavailability. The impact is limited to availability - no confidentiality or integrity exposure is indicated. Critically, the vendor has publicly stated they are unable to reproduce this vulnerability, and the PoC references point exclusively to personal blogs rather than established security research publications, introducing substantial uncertainty about the finding's validity. No public exploit identified at time of analysis has been confirmed by independent researchers or CISA KEV.
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authorization bypass in OutSystems Lifetime allows any authenticated platform user to read Change Logs for applications they are not authorized to access by manipulating the ApplicationID parameter - a classic IDOR exposing audit trails, user action histories, and application names across the management plane. All Lifetime versions prior to 11.28.2.3955 are affected, as confirmed by CERT-PL and the OutSystems vendor advisory. No public exploit code has been identified and EPSS exploitation probability is 0.04% (12th percentile), but the flaw is a meaningful control failure in environments that rely on role-segregated application visibility within Lifetime.
OutSystems Platform Server version 11.18.1.37828 is reported to allow denial of service through HTTP request smuggling (CWE-444) by sending a crafted HTTP request where the Content-Length header value does not match the actual body length, disrupting the server's HTTP parser and causing service unavailability. The impact is limited to availability - no confidentiality or integrity exposure is indicated. Critically, the vendor has publicly stated they are unable to reproduce this vulnerability, and the PoC references point exclusively to personal blogs rather than established security research publications, introducing substantial uncertainty about the finding's validity. No public exploit identified at time of analysis has been confirmed by independent researchers or CISA KEV.
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 (and LifeTime management console before 11.7.0) allows SSRF for arbitrary outbound HTTP requests. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.