CVE-2014-1217

High

Published: 28/04/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, allowing remote attackers to change configurations and obtain the database connection string and credentials.

Risk Assessment

Attackers may change critical system settings, leading to potential data leaks and security breaches within the organization.

Recommendation

It is recommended to upgrade Livetecs Timelive to version 6.2.8 or later to mitigate this vulnerability.

Other vulnerabilities in Livetecs Timelive

CVE-2014-2042High
Livetecs Timelive before version 6.5.1 has an unrestricted file upload vulnerability in the Manage Project functionality. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and accessing it via a direct request.

Original NVD description (English source)

Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, which allows remote attackers to change configurations and obtain the database connection string and credentials via unspecified vectors.