CVE-2022-28924

https://notcve.org/view.php?id=CVE-2022-28924

18 May 2022 — An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/. Una vulnerabilidad de divulgación de información en UniverSIS-Students versiones anteriores a v1.5.0, permite a atacantes obtener información confidencial por medio de una petición GET diseñada al endpoint /api/students/me/courses/ • https://suumcuique.org/blog/posts/information-disclosure-vulnerability-universis • CWE-668: Exposure of Resource to Wrong Sphere •