GHSA-h855-6hph-v363

Hippo4j allows attacker to obtain sensitive info via ConfigVerifyController function of Tenant Management module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-27096

Packages

Ecosystem	Package	Affected	Fixed in
Maven	cn.hippo4j:hippo4j-all	<= 1.4.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-27096 advisory
https://github.com/opengoofy/hippo4j/issues/1060 web
https://github.com/opengoofy/hippo4j package