CVE-2017-16776 Auth bypass in n/a
An attacker can bypass authentication and escalate privileges in the Conserus Workflow Intelligence application via a malicious HTTP GET request.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16776?
CVE-2017-16776 is a high-severity authentication bypass vulnerability in n/a, published on 15 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by McKesson Medical Imaging Company, which is now a Change Healthcare company. The attacker must send a malicious HTTP GET request to exploit the vulnerability. The vulnerability allows an attacker to bypass authentication and escalate privileges of valid users. An unauthenticated attacker can exploit the vulnerability and be granted limited access to other accounts. An authenticated attacker can exploit the vulnerability and be granted access reserved for higher privilege users.
Which versions are affected by CVE-2017-16776?
It affects 1 product.
Products include Mckesson Conserus Workflow Intelligence.
How do I fix CVE-2017-16776?
No fix has been published for CVE-2017-16776 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-16776 being exploited?
There is no known exploitation of CVE-2017-16776 in the wild and no public exploit code.
Sources
Also known as GHSA-w62c-gf7r-6xpr.