VULNERABILITY INTELLIGENCE

CVE-2017-14322

CVSS score9.8 CRITICAL

EPSS probability36.50%

CISA KEVNot currently listed

Published2017-10-18

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remote attackers to bypass authentication and obtain administrative access by using the IEM_CookieLogin cookie with a specially crafted value.

Weakness classification

CWE-287: Improper Authentication

Primary references

cve@mitre.org — Mailing List, Third Party Advisory
cve@mitre.org — Broken Link
cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry