Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.
Credits
Alessandro Bosco, Luca Di Giuseppe, Stefano Scipioni, and Massimiliano Brolli of TIM Security Red Team Research
