Description

GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-24T08:17:03.280Z",
  "pubdate": "2026-09-24T08:17:03.280Z",
  "executiveSummary": "The GPM LIGHT application, developed by ezGlobal, is susceptible to a sensitive data exposure vulnerability resulting from improper access control mechanisms.\nThis flaw allows unauthenticated remote attackers to bypass authorization checks and directly access sensitive system log files.\nThe vulnerability poses a severe risk to confidentiality, as log files frequently contain sensitive information, including system configurations, internal service details, user activity, and potentially credentials or session tokens.\nBy gaining unauthorized access to these diagnostic artifacts, an attacker can conduct reconnaissance, identify further vulnerabilities, or exfiltrate sensitive data without requiring any level of authentication.\nGiven that the application does not mandate authentication for this endpoint, the barrier to exploitation is minimal, potentially allowing for automated or script-based discovery and data harvesting by remote actors.",
  "technicalDetails": "The root cause of the vulnerability lies in an insecure implementation of the application's request handling logic, where specific endpoints responsible for serving system logs are exposed without adequate access control validation or authentication middleware.\nIn a secure configuration, administrative endpoints or log-viewing interfaces must verify that a request originates from an authorized user session. In GPM LIGHT, the application fails to perform these checks, treating requests for log files as public-facing resources.\nThe attack flow involves an unauthenticated remote attacker identifying the specific URL path or API endpoint utilized by GPM LIGHT for log retrieval. Once identified, the attacker sends an unauthenticated HTTP GET request to the target resource.\nBecause the server lacks the necessary authorization logic, it processes the request and streams the contents of the internal log file directly back to the attacker’s client as a standard HTTP response.\nThe impact of this vulnerability is significant, as it facilitates the leakage of sensitive internal system state information. Logs often contain metadata regarding system architecture, internal IP addresses, directory structures, and error messages that reveal backend technologies or code-level exceptions.\nFurthermore, if the application performs verbose logging, it may inadvertently capture sensitive parameters, session identifiers, or PII (Personally Identifiable Information) in plain text. An attacker can leverage this information to map the attack surface of the application, escalate privileges, or conduct further targeted attacks against the underlying infrastructure.\nSince the vulnerability is reachable over the network, it is classified as a remote exposure. There are no known exploitation constraints such as administrative privileges or physical access; the vulnerability is triggered through basic HTTP request manipulation targeting the identified log access endpoint."
}