CVE-2018-17287 Information disclosure in n/a
Attackers can exfiltrate cleartext passwords from the Kofax Front Office Server Administration Console by exploiting the back-end download feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17287?
CVE-2018-17287 is a medium-severity vulnerability in n/a, published on 18 Apr 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation.
Which versions are affected by CVE-2018-17287?
It affects 1 product.
Products include Kofax Front Office Server.
How do I fix CVE-2018-17287?
No fix has been published for CVE-2018-17287 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-17287 being exploited?
There is no known exploitation of CVE-2018-17287 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pjpc-vgm9-wp5g.