CVE-2017-7313
HighSummary
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows reading customer data such as name, master Customer Id, and email address by accessing the /TabId/275 URI. No authentication is required, enabling anyone to search for users in the system.
Risk Assessment
The lack of authentication for accessing customer data poses a serious risk to privacy and the security of personal information. The organization may be vulnerable to identity theft or other forms of abuse.
Recommendation
It is recommended to immediately implement authorization mechanisms for accessing sensitive customer data and to update the system to the latest version to minimize risk.
Other vulnerabilities in Personify360 e-Business
See all- CVE-2017-7314High
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows access to a list of database tables and their columns when creating a new role at the /TabId/275 URI.
- CVE-2017-7312Critical
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows anyone to add a vendor account or read existing vendor account data, including usernames and passwords, by accessing the /TabId/275 URI.
Original NVD description (English source)
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required.