PT-2018-17874 · Steelcase · Roomwizard

Capitan Alfalo · Publicado 2018-02-15 · Atualizado 2018-03-12 · CVE-2018-7056

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions RoomWizard versions prior to 4.4.x

Description The issue allows remote attackers to obtain potentially sensitive information about IP addresses. This is achieved via the "/getGroupTimeLineJSON.action" API endpoint.

Recommendations For versions prior to 4.4.x, update to version 4.4.x or later to resolve the issue. As a temporary workaround, consider restricting access to the "/getGroupTimeLineJSON.action" API endpoint until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-7056

Produtos afetados

Roomwizard

Referências · 3

• 🔥 http://misteralfa-hack.blogspot.cl/2018/02/steelcase-sala-por-favor-y-todos-tus.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7056 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-7056 · Aviso do Fabricante