Description
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
Scores
CVSS v3
9.1
EPSS
0.0005
EPSS Percentile
14.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-200
Status
published
Products (3)
Census/CSWeb
8.0.1 - 8.1.0 alpha
Census/CSWeb
8.1.0 alpha
csprousers/csweb
8.0.1
Published
Mar 23, 2026
Tracked Since
Mar 24, 2026