OutSystems Lifetime Authorization Bypass Vulnerability Allowing Unauthorized Access to Change Logs

A vulnerability in OutSystems Lifetime prior to version 11.28.2.3955 allows for authorization bypass through user-controlled keys in the ApplicationID parameter. This issue enables any authenticated user to access the Change Log, which contains details of actions taken by other users, as well as the names of all applications. The vulnerability arises from insufficient validation of user input, which could be exploited to bypass authorization controls.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive application change logs, allowing users to view actions performed by others and details about various applications.

Remediation

Users can upgrade to OutSystems Lifetime version 11.28.2.3955 or later to address this vulnerability.