4.3med
CVE-2017-20110
Teleopti WFM Administration Credentials information disclosure
Published 4 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known
Summary
A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure (Credentials). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
1.05% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Teleopti WFM
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- seclists.org /fulldisclosure/2017/Feb/13 · x_refsource_MISC, x_transferred
- vuldb.com /?id.96806 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-20110
- NVD: CVE-2017-20110
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.