CVE-2017-14943 Information disclosure in n/a
Attackers can expose emails and hashed passwords by manipulating the userID field in JSON requests to the subscriber management endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-14943?
CVE-2017-14943 is a high-severity vulnerability in n/a, published on 10 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to ManageSubscriber.aspx/GetSubscriber. NOTE: this software is independently deployed at multiple municipal transit systems; it is not found exclusively on the "webwatch.(REDACTED).com" server mentioned in the reference.
Weakness: CWE-200
Which versions are affected by CVE-2017-14943?
It affects 1 product.
Products include Trapezegroup Transitmaster.
How do I fix CVE-2017-14943?
No fix has been published for CVE-2017-14943 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-14943 being exploited?
There is no known exploitation of CVE-2017-14943 in the wild and no public exploit code.
Sources
Also known as GHSA-58g6-vc84-jgc7.