PT-2014-4369 · Visibility · Cyber Recruiter

Published 2014-02-10 · Updated 2014-02-21 · CVE-2014-1930

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Visibility Software Cyber Recruiter versions prior to 8.1.00

Description The issue allows remote attackers to obtain sensitive information by leveraging an unattended workstation, due to the lack of appropriate HTTPS transport and response headers. This affects access to "AppSelfService.aspx" and "AgencyPortal.aspx" in the browser history.

Recommendations For versions prior to 8.1.00, update to version 8.1.00 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints "AppSelfService.aspx" and "AgencyPortal.aspx" to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-1930

Affected Products

Cyber Recruiter

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-1930 · Security Note
• http://vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details · Vendor Advisory
• http://osvdb.org/102814 · Note
• http://kb.cert.org/vuls/id/566894 · Note
• http://securityfocus.com/bid/65305 · Note
• http://jvn.jp/vu/JVNVU97441356/index.html · Note
• http://osvdb.org/102815 · Note