Newgensoft OmniDocs Insecure Direct Object Reference Vulnerability Allowing PII Theft

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Newgensoft OmniDocs version 11.0_SP1_03_006. This vulnerability resides in the 'getuserproperty' function, where improper access control allows unauthorized users to access and steal configuration data and Personally Identifiable Information (PII) from other users.

Impact

Exploitation of this vulnerability leads to unauthorized access to users' configuration and PII, allowing it to be stolen by the attacker.

Remediation

Users can upgrade to Newgensoft OmniDocs version 11.0_SP1_03_016 to address this vulnerability.