CVE-2022-30628

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX

Score

CVSS 3.1 5.5 Medium

Status

Modified - cna@cyber.gov.il

Published

2022-07-21

Last modified

2024-09-16

Affected products

• Supersmart.me - Walk Through (Supersmart)
• Supersmart.me Walk Through (Supersmart.me)

References

• https://www.gov.il/en/Departments/faq/cve_advisories