Cloud Help Desk & Inventory online integration authorization vulnerability

Publish Date: Mar. 8, 2021

We've identified a bug in the Spiceworks Inventory online and Cloud Help Desk products that would allow a user of the Inventory online product to access limited unauthorized information on a "test" account in the Cloud Help Desk, including Cloud Help Desk email addresses and device name information for those admins on the single affected account. Those who are affected have been notified directly.

Cloud Help Desk users that were admin or tech role on a specific "test" account.

Users of the Inventory online product that were not already registered as users of Cloud Help Desk would be shown information about a test Cloud Help Desk account when attempting to use the Inventory online + Cloud Help Desk integration, within the Inventory online product. The expected behavior would be to...