Hello,

A log-in user can grab all the requesters details registered on the portal either they are in the same dapartment or in other companies!!!!! using the url:

https://Your_SDP_Server/workorder/RequesterDialog.jsp?woID=XXXXXX

An iteration on the ID allow the user to collect VERY SENSITIVE data!

We urge you to fix it asap.

Regards,

Vincent