Overview
The DTE Energy Insight app API allows an authenticated user to obtain and query certain limited customer information from other customers.
Description
CWE-200: Information Exposure - CVE-2016-1562 The DTE Energy Insight app lets DTE Energy customers track their energy usage. This information is exposed via an HTTP REST API. |
Impact
A remote, authenticated user may be able to obtain limited information about other customers. |
Solution
DTE Energy has updated its Insight server backend to mitigate this issue. The researcher has confirmed that the APIs no longer allow access to other data. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 4 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| Temporal | 3.1 | E:POC/RL:OF/RC:C |
| Environmental | 2.3 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to Jeffrey Quesnelle for reporting this vulnerability.
This document was written by Garret Wassermann.
Other Information
| CVE IDs: | CVE-2016-1562 |
| Date Public: | 2016-03-10 |
| Date First Published: | 2016-03-11 |
| Date Last Updated: | 2016-03-14 14:28 UTC |
| Document Revision: | 40 |