Vulnerability Details : CVE-2017-20109
Potential exploit
A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /TeleoptiWFM/Administration/GetOneTenant of the component Administration. The manipulation leads to information disclosure (Credentials). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Vulnerability category: Information leak
Products affected by CVE-2017-20109
- Calabrio » Teleopti Workforce ManagementVersions from including (>=) 6.9 and up to, including, (<=) 7.1.0cpe:2.3:a:calabrio:teleopti_workforce_management:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-20109
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 36 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-20109
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
VulDB | |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2017-20109
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: cna@vuldb.com (Secondary)
-
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-20109
-
http://seclists.org/fulldisclosure/2017/Feb/13
Full Disclosure: Teleopti WFM <= 7.1.0 Multiple VulnerabilitiesExploit;Mailing List;Third Party Advisory
-
https://vuldb.com/?id.96805
CVE-2017-20109 | Teleopti WFM Administration GetOneTenant Credentials information disclosureThird Party Advisory
Jump to