Rising Technosoft CAP Back Office Improper Authentication Vulnerability Allowing Unauthorized Access

A vulnerability in the Rising Technosoft CAP back office application, all versions prior to 2.0.4, has been identified. This issue arises from an improper authentication check at an API endpoint, allowing an unauthenticated remote attacker with a valid login ID to exploit the vulnerability. By manipulating API input parameters through the request URL or payload, the attacker could gain unauthorized access to other user accounts.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user accounts, allowing attackers to access sensitive information or perform actions on behalf of the compromised users.

Remediation

Users are advised to upgrade the Rising Technosoft CAP back office application to version 2.0.4 or later.