{"id":"CVE-2018-10207","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-10207","generatedAt":"2026-10-29T00:35:21.454Z","title":"An attacker can exploit Missing Authorization on the FlexPaperViewer SWF reader, and export files that should have been restricted, via vectors involving page-by-page access to a document in SWF format.","description":"An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. An attacker can exploit Missing Authorization on the FlexPaperViewer SWF reader, and export files that should have been restricted, via vectors involving page-by-page access to a document in SWF format.","published":"2018-04-25T18:29:00.000Z","lastModified":"2026-06-17T01:33:41.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-862"],"affected":["vaultize/enterprise file sharing"],"epss":{"score":0.01019,"percentile":0.63212,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.02%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://cds.thalesgroup.com/en/tcs-cert/CVE-2018-10207","source":"cve@mitre.org"},{"url":"https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10207/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.excellium-services.com/cert-xlm-advisory/cve-2018-10207/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-10207","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}