CVE-2017-7312
CriticalSummary
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows anyone to add a vendor account or read existing vendor account data, including usernames and passwords, by accessing the /TabId/275 URI.
Risk Assessment
This vulnerability poses a serious risk to the organization's security by allowing unauthorized users to access sensitive vendor account data.
Recommendation
It is recommended to restrict access to the /TabId/275 URI and to update the system to the latest version to minimize the risk associated with this vulnerability.
Other vulnerabilities in Personify360 e-Business
See all- CVE-2017-7314High
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows access to a list of database tables and their columns when creating a new role at the /TabId/275 URI.
- CVE-2017-7313High
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows reading customer data such as name, master Customer Id, and email address by accessing the /TabId/275 URI. No authentication is required, enabling anyone to search for users in the system.
Original NVD description (English source)
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data (including usernames and passwords).