Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs for all configured notification targets by querying GET /api/v1/targets or related endpoints.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/parseablehq/parseable/commit/f307c4989cc9f3ff4204fd383dec7a3…
disclosure@vulncheck.com
https://github.com/parseablehq/parseable/issues/1693
disclosure@vulncheck.com
https://github.com/parseablehq/parseable/pull/1698
disclosure@vulncheck.com
https://github.com/parseablehq/parseable/releases/tag/v2.9.2
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/parseable-cleartext-credential-exposure-in…
disclosure@vulncheck.com