CVE-2017-14322

Critical

Published: 18/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The function in charge of checking whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.

Risk Assessment

Attackers can gain unauthorized access to the system, potentially leading to serious data breaches and control over the application.

Recommendation

It is recommended to update Interspire Email Marketer to version 6.1.6 or later to mitigate this vulnerability.

Original NVD description (English source)

The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.