Description

Although the requests for inquiry of expenses and movements associated with a credit card send the encrypted product number, it is possible to make the inquiry from the session of an account other than the one associated with the credit card.

Impact

Obtain expense information from other users.

Recommendation

Verify that the user who is trying to access the information has the necessary permissions to do so.

Threat

Authorized user from the Internet with access to the encrypted product number.

Expected Remediation Time

⏱️ 60 minutes.

Requirements

Fixes