CVE-2017-7312

Critical

Published: 07/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows anyone to add a vendor account or read existing vendor account data, including usernames and passwords, by accessing the /TabId/275 URI.

Risk Assessment

This vulnerability poses a serious risk to the organization's security by allowing unauthorized users to access sensitive vendor account data.

Recommendation

It is recommended to restrict access to the /TabId/275 URI and to update the system to the latest version to minimize the risk associated with this vulnerability.

Original NVD description (English source)

An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data (including usernames and passwords).