The flaw causes sensitive information to be embedded in data transmitted by the application. It also allows users to invoke functionality that is not adequately protected by access control lists. This issue is a textbook case of CWE‑201, where sensitive data is handled insecurely, enabling unintended disclosure and potentially compromising confidentiality and integrity for authenticated users.

Parla Auto Automotive Trading Limited Company’s DetaWix Mobile Web Portal, with all releases prior to version 1.0.19 affected. No other vendors or product variants are listed as impacted.

The CVSS score of 7.5 indicates high severity. Based on the description, it is inferred that an attacker would need to interact with the mobile web portal or sniff the data it sends to exploit the flaw. The EPSS score is not available, so the current probability of exploitation cannot be quantified. The vulnerability is not in the CISA KEV catalog, and no public exploits have been documented, meaning current risk remains primarily dependent on the potential for sensitive data exposure.