> JapanHacked_
[Resolved][Severity: Moderate][Misconfiguration]

EPARK: a cache fault after adding a feature to its reservation site showed names, reservation history and other data of some members on other members' screens, up to 4,949 records

A fault from a feature addition showed some members' information on other members' screens, up to 4,949 records.

Disclosed

2021-05-31

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. After a feature was added, a fault began that showed some members' information on the screens of unrelated members. [1] [2]

  2. The fault was resolved. [1] [2]

  3. It announced the case. [2]

Impact

The problem came to light from a customer's phone call around noon. The data that may have been shown wrongly is, at most, 3,755 records in the name and nickname part, 4,949 records on the reception status and reservation history screens, and 1,228 and 74 records on other screens. Names and phone numbers may have been shown for up to 163 records. [1] [2]

Timeline

  1. Started, Detected 2021-05-26
  2. Disclosed 2021-05-31
  3. 5 days

Attack or cause

Method
[Misconfiguration]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[Name][Phone number]

Services hit

Organizations involved

Open in organization search

Sources

  1. [1][News]予約サイト「EPARK」で別会員情報を誤表示 - キャッシュ処理で不具合Security NEXT · 2021-06-09
  2. [2][News]EPARKサイトで他の会員情報が誤表示、機能追加に伴う障害が原因ScanNetSecurity · 2021-06-16 08:00