CVE-2017-20111

A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

CVSS v3 7.3 HIGH
CVSS v2.0 7.5 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://seclists.org/fulldisclosure/2017/Feb/13	Exploit Mailing List Third Party Advisory
https://vuldb.com/?id.96807	Third Party Advisory
http://seclists.org/fulldisclosure/2017/Feb/13	Exploit Mailing List Third Party Advisory
https://vuldb.com/?id.96807	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:calabrio:teleopti_workforce_management:7.1.0:*:*:*:*:*:*:*

History

21 Nov 2024, 03:22

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2017/Feb/13 - Exploit, Mailing List, Third Party Advisory~~	() http://seclists.org/fulldisclosure/2017/Feb/13 - Exploit, Mailing List, Third Party Advisory
References	~~() https://vuldb.com/?id.96807 - Third Party Advisory~~	() https://vuldb.com/?id.96807 - Third Party Advisory
CVSS	v2 : ~~7.5~~ v3 : ~~9.8~~	v2 : 7.5 v3 : 7.3

Information

Published : 2022-06-29 07:15

Updated : 2024-11-21 03:22

NVD link : CVE-2017-20111

Mitre link : CVE-2017-20111

CVE.ORG link : CVE-2017-20111

JSON object : View

Products Affected

calabrio

teleopti_workforce_management

CWE

CWE-269

Improper Privilege Management

NVD-CWE-noinfo

{"id": "CVE-2017-20111", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-06-29T07:15:07.497", "references": [{"url": "http://seclists.org/fulldisclosure/2017/Feb/13", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.96807", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "http://seclists.org/fulldisclosure/2017/Feb/13", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.96807", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as critical, was found in Teleopti WFM 7.1.0. This affects an unknown part of the component Administration. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad, clasificada como cr\u00edtica, en Teleopti WFM 7.1.0. Esto afecta a una parte desconocida de la Administraci\u00f3n del componente. La manipulaci\u00f3n conlleva una administraci\u00f3n inapropiada de privilegios. Es posible iniciar el ataque de forma remota. La explotaci\u00f3n ha sido divulgada al p\u00fablico y puede ser usada. Es recomendado aplicar un parche para corregir este problema"}], "lastModified": "2024-11-21T03:22:39.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:calabrio:teleopti_workforce_management:7.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D022CE81-9DBF-4EA4-B529-72B8DF0E385D"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}