What is the CVSS score of CVE-2014-0347?

CVE-2014-0347 has a CVSS 2.0 base score of 3.5 (Low). CVSS vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. EPSS exploitation probability: 0.2%.

Triton Unified Security Center CVE-2014-0347

LOW

Credentials Management Errors (CWE-255)

2014-04-12 cret@cert.org

Authentication Bypass Triton Unified Security Center Triton Web Filter Triton Web Security Triton Web Security Gateway Triton Web Security Gateway Anywhere

3.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:M/Au:S/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:S/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 12, 2014 - 04:37 cve.org

LOW 3.5

DescriptionCVE.org

The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-255. The Settings module in Websense Triton Unified Security Center 7.7.3 before Hotfix 31, Web Filter 7.7.3 before Hotfix 31, Web Security 7.7.3 before Hotfix 31, Web Security Gateway 7.7.3 before Hotfix 31, and Web Security Gateway Anywhere 7.7.3 before Hotfix 31 allows remote authenticated users to read cleartext passwords by replacing type="password" with type="text" in an INPUT element in the (1) Log Database or (2) User Directories component. Affected products include: Websense Triton Unified Security Center, Websense Triton Web Filter, Websense Triton Web Security, Websense Triton Web Security Gateway, Websense Triton Web Security Gateway Anywhere.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.