T-INNOVA Deporsite Insecure Direct Object Reference Vulnerability

An insecure direct object reference vulnerability has been identified in the Deporsite application by T-INNOVA, specifically in version 05.29.0907 of the Deporsite Module. This vulnerability allows an attacker to access sensitive information from other users by exploiting the 'idUsuario' parameter in the '/helper/Familia/establecerUsuarioSeleccion' endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information.

Remediation

The vulnerability has been fixed in the Deporsite Module version 2024.02 (DSuite2024 v06.1287 fix2). T-INNOVA has applied the patch for affected customers.