CVEvulnerability
CVE-2017-14322
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-10-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-287
Description
The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.
Affected configurations
• interspire email marketer (<= 6.1.5)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://seclists.org/fulldisclosure/2017/Oct/39 Mailing List, Third Party Advisory
- https://security.infoteam.ch/en/blog/posts/narrative-of-an-incident-response-from-compromise-to-the-publication-of-the-weakness.html Broken Link
- https://www.exploit-db.com/exploits/44513/ Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Oct/39 Mailing List, Third Party Advisory
- https://security.infoteam.ch/en/blog/posts/narrative-of-an-incident-response-from-compromise-to-the-publication-of-the-weakness.html Broken Link
- https://www.exploit-db.com/exploits/44513/ Exploit, Third Party Advisory, VDB Entry