This vulnerability involves an information disclosure flaw (CWE-200) where a backup SQL file containing sensitive database information is accessible without authentication through a specific URL path. An attacker can retrieve the entire database content, including schema details and credential hashes, by sending an unauthenticated HTTP GET request to /obs/database/obs_db.sql on the affected system. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.5, reflecting its network attack vector, low complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information available, and no affected versions have been explicitly identified.

An attacker can remotely obtain the full database contents, including sensitive information such as database schema and credential hashes, without any authentication. This exposure can lead to further attacks such as credential cracking or database manipulation. The confidentiality of the system is severely impacted, but integrity and availability are not directly affected according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to backup files and sensitive directories on the web server, and remove or secure any publicly accessible database backup files. Implement proper access controls to prevent unauthenticated access to sensitive resources.