Lucene search

[email protected]CVE-2014-1930

HistoryFeb 10, 2014 - 10:55 p.m.

CVE-2014-1930

2014-02-1022:55:03

CWE-200

[email protected]

web.nvd.nist.gov

cve-2014-1930

cyber recruiter

https

response headers

sensitive information

remote attackers

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.4 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.0%

JSON

Visibility Software Cyber Recruiter before 8.1.00 does not use the appropriate combination of HTTPS transport and response headers to prevent access to (1) AppSelfService.aspx and (2) AgencyPortal.aspx in the browser history, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.

Affected configurations

NVD

Node

visibility_softwarecyber_recruiterRange≤8.0

visibility_softwarecyber_recruiterMatch6.2

visibility_softwarecyber_recruiterMatch6.4

visibility_softwarecyber_recruiterMatch6.6

visibility_softwarecyber_recruiterMatch6.8

visibility_softwarecyber_recruiterMatch7.0

visibility_softwarecyber_recruiterMatch7.2

CPENameOperatorVersion
visibility_software:cyber_recruitervisibility software cyber recruiterle8.0
visibility_software:cyber_recruitervisibility software cyber recruitereq6.2
visibility_software:cyber_recruitervisibility software cyber recruitereq6.4
visibility_software:cyber_recruitervisibility software cyber recruitereq6.6
visibility_software:cyber_recruitervisibility software cyber recruitereq6.8
visibility_software:cyber_recruitervisibility software cyber recruitereq7.0
visibility_software:cyber_recruitervisibility software cyber recruitereq7.2

CPE	Name	Operator	Version
visibility_software:cyber_recruiter	visibility software cyber recruiter	le	8.0
visibility_software:cyber_recruiter	visibility software cyber recruiter	eq	6.2
visibility_software:cyber_recruiter	visibility software cyber recruiter	eq	6.4
visibility_software:cyber_recruiter	visibility software cyber recruiter	eq	6.6
visibility_software:cyber_recruiter	visibility software cyber recruiter	eq	6.8
visibility_software:cyber_recruiter	visibility software cyber recruiter	eq	7.0
visibility_software:cyber_recruiter	visibility software cyber recruiter	eq	7.2

References

jvn.jp/vu/JVNVU97441356/index.html

osvdb.org/102814

osvdb.org/102815

www.kb.cert.org/vuls/id/566894

www.securityfocus.com/bid/65305

www.vspublic.com/help/Cyber%20Recruiter/default.aspx?pageid=release_details

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.4 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.0%

JSON

Related for CVE-2014-1930

cvelist1 prion1 nvd1