CVE-2017-17707

{"id": "CVE-2017-17707", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2018-07-31T14:29:00.293", "references": [{"url": "https://www.profundis-labs.com/advisories/CVE-2017-17707.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding \"CredentialId\" value, which uniquely identifies a password safe entry. Since \"CredentialId\" values are implemented as GUIDs, they are hard to guess. However, if for example an entry's owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants."}, {"lang": "es", "value": "Debido a la falta de comprobaciones de autorizaci\u00f3n, cualquier usuario autenticado puede listar, subir o eliminar adjuntos a entradas password safe en Pleasant Password Server en versiones anteriores a la 7.8.3. Para realizar estas acciones sobre una entrada, el usuario necesita conocer el valor \"CredentialId\", que identifica de forma \u00fanica una entrada password safe. Como los valores \"CredentialId\" se implementan como GUID, son dif\u00edciles de adivinar. Sin embargo, si el propietario de una entrada, por ejemplo, otorga acceso de solo lectura a un usuario malicioso, el valor ser\u00e1 expuesto a este usuario malicioso. Lo mismo ocurre con los permisos temporales."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pleasantsolutions:pleasant_password_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBE79A77-C056-4042-AE9F-89F6D669500E", "versionEndExcluding": "7.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}