image credit: adobe stock
Described as insecure direct object reference (IDOR) issues, they allow threat actors to read or tamper with sensitive data via application programming interface (API) requests that include the identifier of a valid user.
These requests are successful because the authentication or authorization of the user submitting the request is not properly validated, the three agencies explain.
Comments are closed.
