CVE-2017-7314
HighSummary
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows access to a list of database tables and their columns when creating a new role at the /TabId/275 URI.
Risk Assessment
Access to the database structure may lead to unauthorized information disclosure, increasing the risk of attacks on the system.
Recommendation
It is recommended to restrict access to the /TabId/275 URI and review user permissions to secure the data.
Other vulnerabilities in Personify360 e-Business
See all- CVE-2017-7313High
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows reading customer data such as name, master Customer Id, and email address by accessing the /TabId/275 URI. No authentication is required, enabling anyone to search for users in the system.
- CVE-2017-7312Critical
An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows anyone to add a vendor account or read existing vendor account data, including usernames and passwords, by accessing the /TabId/275 URI.
Original NVD description (English source)
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available.