This seems strange for an unauth access vuln to be assessed as a MED vs HIGH.   What type of access does this provide upon exploit?   Is interactive admin-level access possible, either directly or indirectly as a result of the vulnerability?  Thanks ...