{"api_version":"1","generated_at":"2026-07-23T10:42:30+00:00","cve":"CVE-2018-17486","urls":{"html":"https://cve.report/CVE-2018-17486","api":"https://cve.report/api/cve/CVE-2018-17486.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-17486","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-17486"},"summary":{"title":"CVE-2018-17486","description":"Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visitor function while in kiosk mode. By visiting the kiosk and selecting find visitor, an attacker could exploit this vulnerability to delete visitor records or remove a host.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2019-03-21 16:00:00","updated_at":"2020-08-24 17:37:00"},"problem_types":["NVD-CWE-noinfo"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/149646","name":"lobby-track-cve201817486-sec-bypass (149646)","refsource":"XF","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-17486","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17486","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"17486","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jollytech","cpe5":"lobby_track","cpe6":"8.2.186","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"desktop","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"17486","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jollytech","cpe5":"lobby_track","cpe6":"8.2.186","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"desktop","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Lobby Track Desktop","version":{"version_data":[{"version_value":"8.2.186"}]}}]},"vendor_name":"Jolly Technologies"}]}},"impact":{"cvssv3":{"TM":{"RC":"R","RL":"U","E":"U"},"BM":{"C":"N","AC":"H","SCORE":"2.900","I":"L","AV":"L","PR":"N","A":"N","UI":"N","S":"U"}}},"data_format":"MITRE","CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2019-03-04T00:00:00","STATE":"PUBLIC","ID":"CVE-2018-17486"},"data_type":"CVE","problemtype":{"problemtype_data":[{"description":[{"value":"Bypass Security","lang":"eng"}]}]},"description":{"description_data":[{"value":"Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visitor function while in kiosk mode. By visiting the kiosk and selecting find visitor, an attacker could exploit this vulnerability to delete visitor records or remove a host.","lang":"eng"}]},"data_version":"4.0","references":{"reference_data":[{"title":"X-Force Vulnerability Report","name":"lobby-track-cve201817486-sec-bypass (149646)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/149646"}]}},"nvd":{"publishedDate":"2019-03-21 16:00:00","lastModifiedDate":"2020-08-24 17:37:00","problem_types":["NVD-CWE-noinfo"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:N/I:P/A:P","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":3.6},"severity":"LOW","exploitabilityScore":3.9,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:jollytech:lobby_track:8.2.186:*:*:*:desktop:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"17486","Ordinal":"134299","Title":"CVE-2018-17486","CVE":"CVE-2018-17486","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"17486","Ordinal":"1","NoteData":"Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visitor function while in kiosk mode. By visiting the kiosk and selecting find visitor, an attacker could exploit this vulnerability to delete visitor records or remove a host.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"17486","Ordinal":"2","NoteData":"2019-03-19","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"17486","Ordinal":"3","NoteData":"2019-03-19","Type":"Other","Title":"Modified"}]}}}