Secobserve
Monthly
Information disclosure in SecObserve versions 1.17.0 through 1.59.0 allows an authenticated, low-privileged user holding only view-only membership in a product to read the decrypted HTTP basic-auth password stored for scanner or integration service accounts. Because the ApiConfigurationSerializer fails to strip the basic_auth_password field from API responses, the secret is exposed through standard REST endpoints to any account with `reader` rights; no administrator privileges, user interaction, or special configuration are required beyond the existence of at least one basic-auth-configured integration. Impact is confined to credential confidentiality (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis. This is a genuine but bounded credential-disclosure issue, best treated as a medium-priority patch rather than an emergency.
Information disclosure in SecObserve versions 1.17.0 through 1.59.0 allows an authenticated, low-privileged user holding only view-only membership in a product to read the decrypted HTTP basic-auth password stored for scanner or integration service accounts. Because the ApiConfigurationSerializer fails to strip the basic_auth_password field from API responses, the secret is exposed through standard REST endpoints to any account with `reader` rights; no administrator privileges, user interaction, or special configuration are required beyond the existence of at least one basic-auth-configured integration. Impact is confined to credential confidentiality (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis. This is a genuine but bounded credential-disclosure issue, best treated as a medium-priority patch rather than an emergency.