Auth bypass in Pleasantsolutions Pleasant Password Server
CVE-2017-17707
Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely identifies a password safe entry. Since "CredentialId" values are implemented as GUIDs, they are hard to guess. However, if for example an entry's owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants.
Vulnerability class: Broken Access Control
EPSS: 0.008 (54.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Pleasantsolutions Pleasant_password_server
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-17707?
- CVE-2017-17707 is a high-severity vulnerability in Pleasantsolutions Pleasant Password Server, classified under Missing Authorization. CVSS score: 8.1/10. Published 2018-07-31.
- How severe is CVE-2017-17707?
- High severity. CVSS v3 base score is 8.1 out of 10.