Researchers from Cybernews found that BMW exposed sensitive files produced by a framework that BMW Italy uses.
While this information is insufficient for threat actors to hack the website, researchers observed that it may be used for reconnaissance, or secretly learning and gathering data about a system.
Data may tip attackers in the direction of client information storage and the methods to access it, which could result in the website being compromised.
The business might have either utilized a vulnerable version of Laravel or it might have been accidentally misconfigured by someone using a current version.
Source: https://securityaffairs.com/143297/data-breach/bmw-exposes-clients-italy.html
"id": "BMW181781023",
"linkid": "bmw-group",
"type": "Breach",
"date": "03/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"