PT-2017-14550 · Conserus · Conserus Workflow Intelligence

Publicado 2017-12-15 · Atualizado 2019-10-03 · CVE-2017-16776

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Conserus Workflow Intelligence version 2.0.2

Description The issue allows an attacker to bypass authentication and escalate privileges of valid users by sending a malicious HTTP GET request. This enables an unauthenticated attacker to gain limited access to other accounts, while an authenticated attacker can gain access reserved for higher privilege users.

Recommendations For Conserus Workflow Intelligence version 2.0.2, consider restricting access to sensitive areas of the application until a patch is available. As a temporary workaround, limit the privileges of all users to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2017-16776

Produtos afetados

Conserus Workflow Intelligence

Referências · 3

• 🔥 https://technical.nttsecurity.com/post/102emjm/conserus-workflow-intelligence-authentication-bypass-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2017-16776 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16776 · Nota de Segurança