CVE-2017-14322

35Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 37%

from disclosure to weapon160 days

Published on NVDOct 18

1st PoC+160d

exploitation probability

37%top 2% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/joesmithjaffa/CVE-2017-14322★ 5 exploitdbwww.exploit-db.com/exploits/44513unverified cve_referencewww.exploit-db.com/exploits/44513/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://seclists.org/fulldisclosure/2017/Oct/39 https://security.infoteam.ch/en/blog/posts/narrative-of-an-incident-response-from-compromise-to-the-publication-of-the-weakness.html https://www.exploit-db.com/exploits/44513/