CVE-2022-24187 - CVE House
Back to Database
Status published Unknown CVE-2022-24187

The user_id and device_id on the Ourphoto App version 1.4.1...

Vulnerability Description

The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an attacker to discover sensitive information such as end-user email addresses, and their unique frame_token value of all other Ourphoto App end-users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24187

Credits & Attribution

No credits recorded in the NVD database.

References

More from sz-fujia

View All →
CVE-2022-24190
The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not...
Unknown 0
CVE-2022-24189
The user_token authorization header on the Ourphoto App version 1.4.1...
Unknown 0
CVE-2022-24188
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses...
Unknown 0

Affected Vendor

Affected Software

ourphoto
Vulnerable Versions:
1.4.1

Timeline

Official Publish: November 28th, 2022
Last Modified: April 29th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.