Vulnerability in Websense Triton Unified Security Center
CVE-2014-0347
The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.
EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.
Affected products
- Websense Triton_unified_security_center — versions 7.7.3
- Websense Triton_web_filter — versions 7.7.3
- Websense Triton_web_security — versions 7.7.3
- Websense Triton_web_security_gateway — versions 7.7.3
- Websense Triton_web_security_gateway_anywhere — versions 7.7.3
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cret@cert.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2014-0347?
- CVE-2014-0347 is a vulnerability in Websense Triton Unified Security Center, classified under CWE-255. Published 2014-04-12.
- Is CVE-2014-0347 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.