Vulnerability in Websense Triton Unified Security Center
CVE-2014-0347
The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 3.5 (Low). Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.013 (70.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 70.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Websense Triton Unified Security Center — versions 7.7.3
- Websense Triton Web Filter — versions 7.7.3
- Websense Triton Web Security — versions 7.7.3
- Websense Triton Web Security Gateway — versions 7.7.3
- Websense Triton Web Security Gateway Anywhere — versions 7.7.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.kb.cert.org/vuls/id/568252 (US Government Resource, third-party-advisory)
- www.websense.com/content/mywebsense-hotfixes.aspx
Frequently asked questions
- What is CVE-2014-0347?
- CVE-2014-0347 is a vulnerability in Websense Triton Unified Security Center, classified under CWE-255. Published 2014-04-12.
- Is CVE-2014-0347 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.