CVE-2023-30059

6th percentile - higher than 6% of all known CVEs

An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request.

The vulnerability may allow an attacker to gain unauthorized access to other users' data and to send support calls on their behalf. This can lead to a breach of confidentiality and integrity.

Update MK-Auth to a version containing the fix or implement server-side object access control. Also verify that authorization checks for the chamado parameter are correct.