PT-2017-17657
CVE-2017-7313
·
Published
2017-06-07
·
Updated
2017-06-14
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Personify360 e-Business versions 7.5.2 through 7.6.1
Description
An issue in the software allows unauthorized access to customer information. By visiting the "/TabId/275" API endpoint, an attacker can read customer names, master Customer Ids, and email addresses without requiring authentication.
Recommendations
For versions 7.5.2 through 7.6.1, restrict access to the "/TabId/275" API endpoint to prevent unauthorized data access. Consider implementing proper authentication mechanisms to protect customer information.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾