Overview
Visibility Software Cyber Recruiter fails to prevent unauthenticated users from accessing protected webpages.
Description
CWE-305: Authentication Bypass by Primary Weakness: Visibility Software Cyber Recruiter fails to prevent unauthenticated users from accessing protected webpages allowing unauthenticated user to view protected data hosted on the website via the AppSelfService.aspx and AgencyPortal.aspx webpages. |
Impact
An unauthenticated attacker can bypass authentication and view protected data hosted on the website via the AppSelfService.aspx and AgencyPortal.aspx webpages. |
Solution
Update |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| Temporal | 3.6 | E:F/RL:OF/RC:C |
| Environmental | 1.0 | CDP:L/TD:L/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to Brad Arndt and Michael Ledford for reporting this vulnerability.
This document was written by Michael Orlando.
Other Information
| CVE IDs: | None |
| Date Public: | 2014-01-27 |
| Date First Published: | 2014-02-03 |
| Date Last Updated: | 2014-02-03 18:01 UTC |
| Document Revision: | 11 |