Threshold eVisitorPass Multiple Security Vulnerabilities

Bugtraq ID:	107422
Class:	Unknown
CVE:	CVE-2018-17493 CVE-2018-17494 CVE-2018-17495 CVE-2018-17496 CVE-2018-17497
Remote:	No
Local:	Yes
Published:	Mar 04 2019 12:00AM
Updated:	Mar 04 2019 12:00AM
Credit:	Hannah Robbins and Scott Brink from X-Force Red research team.
Vulnerable:	Threshold eVisitorPass 1.5.5.2
Not Vulnerable:

Threshold eVisitorPass Multiple Security Vulnerabilities

Threshold eVisitorPass is prone to the following vulnerabilities:

1. Multiple privilege escalation vulnerabilities
2. An insecure default-password vulnerability

An attacker may leverage these issues to perform certain unauthorized actions, gain elevated privileges and gain access to the affected application.

Threshold eVisitorPass version 1.5.5.2 is vulnerable.

Threshold eVisitorPass Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Threshold eVisitorPass Multiple Security Vulnerabilities

References:

• Stranger Danger: X-Force Red Finds 19 Vulnerabilities in Visitor Management Syst (IBM)
  
• Threshold Home Page (Threshold)
  
• Threshold Product Page (Threshold)
  
• Threshold Release Notes (Threshold)