← Database

CVE-2021-36388

HIGH CVSS: 7.5 Published: 2021-10-14 Modified: 2026-06-17

Description

In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".

Affected Platforms

Yellowfinbi Yellowfin

Weakness Type

CWE-639

References