CordysCRM versions before 1.7.2 have an information exposure vulnerability (CWE-200) due to the McpController.getMcpField method being accessible without authentication. The ShiroFilter configuration marks the /mcp/** path as anonymous, and the controller lacks permission annotations, allowing unauthenticated GET requests to retrieve detailed form configuration data. This data includes field names, types, required flags, default values, options, validation rules, and binding sources. Such exposure can enable attackers to understand the internal data model and craft more precise attacks against the system. The vulnerability is resolved in version 1.7.2.

An unauthenticated attacker can obtain sensitive metadata about CRM module forms, including field properties and validation rules. This exposure does not directly allow modification or access to user data but facilitates reconnaissance that can lead to more effective attacks against other inputs or components of the application. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges required, and no user interaction needed.

Upgrade CordysCRM to version 1.7.2 or later, where this issue is fixed by adding proper authentication and permission checks to the affected endpoint. No other mitigation is required as the vendor has provided an official fix.