VulnerabilityAnalyzed

CVE-2020-36926

SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details.

MEDIUM 6.9EPSS 0.57%

Does this matter?

Lower severity and a low EPSS score (0.57%). Track it; it rarely justifies an emergency change on its own.

Description

SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique identifiers.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.57% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-497
Affected: smartertools/smartertrack
Source: disclosure@vulncheck.com

References

https://www.exploit-db.com/exploits/50328Exploit
https://www.smartertools.com/Product
https://www.smartertools.com/smartertrackProduct
https://www.vulncheck.com/advisories/smartertools-smartertrack-information-disclosureThird Party Advisory
https://www.exploit-db.com/exploits/50328Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.