2.9low
CVE-2018-17486
Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visitor function while in…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
2.9
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 25%
Public exploits
0
none known
Summary
Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visitor function while in kiosk mode. By visiting the kiosk and selecting find visitor, an attacker could exploit this vulnerability to delete visitor records or remove a host.
Exploit prediction (EPSS)
0.32% probability of exploitation in the next 30 days, higher than 25% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 2.9 | CVSS:3.0/C:N/AC:H/I:L/AV:L/PR:N/A:N/UI:N/S:U/RC:R/RL:U/E:U |
| CNA | 3.0 | 2.9 | CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 3.6 | AV:L/AC:L/Au:N/C:N/I:P/A:P |
Affected products
- Jolly Technologies Lobby Track Desktop
References
- exchange.xforce.ibmcloud.com /vulnerabilities/149646 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2018-17486
- NVD: CVE-2018-17486
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.