4.0med
CVE-2018-17482
Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
4.0
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 29%
Public exploits
0
none known
Summary
Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiting the kiosk and clicking on reports, an attacker could exploit this vulnerability to gain access to all visitor records and obtain sensitive information.
Exploit prediction (EPSS)
0.35% probability of exploitation in the next 30 days, higher than 29% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 4.0 | CVSS:3.0/AC:L/C:L/I:N/AV:L/PR:N/A:N/UI:N/S:U/RC:R/E:U/RL:U |
| CNA | 3.0 | 4.0 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Jolly Technologies Lobby Track Desktop
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- exchange.xforce.ibmcloud.com /vulnerabilities/149642 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2018-17482
- NVD: CVE-2018-17482
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.