{"id":"GSD-2022-1002519","summary":"Information Leakage in Analytics version curent as of 2022-05-19","details":"In the Google Analytics admin web interface, current as of 2022-05-19 an information leakage exists in the Account Access Management and Property Access Management that can be used, resulting in an attacker determining if a Google-hosted email address is in fact a Google account or a google group, an alias to a user, or a user account. Additionally, if it is an alias Google will report the real email address associated with the alias.\r\n\r\nIf it's an account it will add it (e.g. kurt@seifried.org).\r\n\r\nIf it's a google group it will error out with: \"Failed to register users\" (e.g. group@seifried.org)\r\n\r\nIf it is an alias, it will error out with \"One of the email addresses entered is the alternate email address of a Google Account (e.g. alias@seifried.org). The alternate email address has been changed to that account's primary email address.\" and it will change the email alias to the correct email.\r\n","modified":"2023-03-14T07:01:09.290966Z","published":"2022-05-20T03:09:17.390678Z","withdrawn":"2023-03-14T07:01:09.290966Z","references":[{"type":"WEB","url":"https://analytics.google.com/analytics/web/#/"}],"schema_version":"1.7.3"}