Platform Incorrect Access Control Vulnerability in ApiOrderService.java Allowing Sensitive Information Disclosure

A vulnerability exists in the 'platform' application, specifically in version 1.0.0, within the 'ApiOrderService.java' component. The issue arises from improper access control, which enables attackers to access sensitive information by sending a crafted request. The vulnerability is exploited by manipulating the 'couponId' parameter to access and use someone else's coupon, thereby reducing the amount spent on purchases.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, specifically through the misuse of coupons, allowing attackers to fraudulently reduce purchase costs.