EXPLOITING VULNERABILITIES IN JOHNSON & JOHNSON WEB APPS

Summary from the TLDR Dev newsletter

Two vulnerabilities were identified in Johnson & Johnson's web applications, one affecting a campus recruiting system that exposed nearly 1,000 students' details, and the other allowing administrative takeover of an internal audit system used by 20 companies. The campus recruiting vulnerability came from a simple misconfiguration where an API key was used instead of proper token authentication, while the audit system's flaw involved unauthenticated access to sensitive employee information through poorly secured APIs.