3485247 - Exposure of Domains and Subdomains in Authentication Service Response

During the analysis of the intermediate authentication processes on the platform, it was identified that a response provided by the authentication service contains a variable that exposes information about the client's domains and subdomains. This vulnerability allows obtaining a list of domains and subdomains, including many that are development or private, which should not be publicly accessible.

Exposed variable is “var_validDomains"

SAP Customer Data Cloud

Gigya, CDC, vulnerability, variable exposure, var_validDomains , KBA , CEC-PRO-RAS , RaaS (Screen-Sets, Site Policies, Schema) , Problem