BBMRI-ERIC Negotiator Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in BBMRI-ERIC Negotiator version 3.15.2. This vulnerability enables an attacker to access or modify unauthorized resources by manipulating requests that include the 'userID' parameter in the '/api/v3/users/<userID>' endpoint. Exploitation of this vulnerability could lead to the exposure or unauthorized alteration of sensitive data.

Impact

Exploitation of this vulnerability could result in unauthorized access to or modification of sensitive data.

Remediation

Users can upgrade to BBMRI-ERIC Negotiator version 3.15.5 to address this vulnerability.