PT-2017-14550 · Conserus · Conserus Workflow Intelligence

Published 2017-12-15 · Updated 2019-10-03 · CVE-2017-16776

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Conserus Workflow Intelligence version 2.0.2

Description The issue allows an attacker to bypass authentication and escalate privileges of valid users by sending a malicious HTTP GET request. This enables an unauthenticated attacker to gain limited access to other accounts, while an authenticated attacker can gain access reserved for higher privilege users.

Recommendations For Conserus Workflow Intelligence version 2.0.2, consider restricting access to sensitive areas of the application until a patch is available. As a temporary workaround, limit the privileges of all users to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2017-16776

Affected Products

Conserus Workflow Intelligence

References · 3

• 🔥 https://technical.nttsecurity.com/post/102emjm/conserus-workflow-intelligence-authentication-bypass-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2017-16776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16776 · Security Note