Eleveo
Monthly
Insufficient session expiration in Eleveo Call Recording Software (versions up to and including 10.3.0) leaves the Keycloak OpenID Connect logout endpoint at /auth/realms/default/protocol/openid-connect/logout unable to fully invalidate session state, so a session can persist after a user believes they have logged out (CWE-613). Exploitation requires an attacker to already hold a low-privileged authenticated account (PR:L) and depends on passive user interaction (UI:P), such as a victim performing or relying on a logout action; the resulting impact is limited to minor confidentiality exposure (VC:L) with no integrity or availability effect. Publicly available exploit code exists, no confirmed active exploitation has been reported, and with a CVSS 4.0 base score of 2.0 this is a genuinely low-priority issue despite being remotely reachable.
Eleveo Call Recording Software up to 10.3.0 transmits the OpenID Connect id_token_hint JWT as a GET query-string parameter on its logout endpoint (/auth/realms/default/protocol/openid-connect/logout), allowing that token to be captured from browser history, referrer headers, proxy caches, or server access logs. Exploitation is remote but constrained: the CVSS vector indicates a low-privileged authenticated context (PR:L), passive user interaction (UI:P), and high attack complexity (AC:H), with the vendor itself stating exploitability is difficult, and impact limited to low confidentiality disclosure of the token - no integrity or availability effect. Publicly available exploit code exists and the disclosure has been published, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall CVSS base score is only 1.2, making this a very low-priority issue.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privilege remote attacker to read sensitive data via the createAndSaveAudit function of the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. Publicly available exploit code exists, but exploitation requires a valid session and network access to the web tier, and the impact is limited to confidentiality with no integrity or availability effect. No vendor patch has been identified; the vendor did not respond to the disclosure.
LDAP injection in Eleveo Call Recording Software 9.7.0 lets an authenticated, low-privileged user manipulate the Username argument of the User Management endpoint /callrec/userAddAction.do so that unsanitized input is incorporated into an LDAP directory query, resulting in low-impact disclosure of directory information. The attack is reachable remotely and requires no user interaction, but it is gated behind a valid low-privilege account and a deployment whose user management is backed by an LDAP directory. Publicly available exploit code exists, including a proof-of-concept linked from the VulDB disclosure, and the vendor was contacted but did not respond; EPSS and CISA KEV do not indicate confirmed active exploitation. With a CVSS 5.3 base score and confidentiality-only impact (C:L, no integrity or availability effect), this is a high-CVSS-appearance-but-modest-real-risk issue.
Improper access control in Eleveo Call Recording Software 9.7.0 allows a low-privilege authenticated user to exercise functionality reachable through the Query Builder endpoint /callrec/searchAction.do that should require higher privileges, resulting in limited unauthorized read and manipulation of call-recording data. The flaw is remotely reachable over the web interface with low attack complexity and no user interaction, and the assessed vector (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CVSS 4.0 base 5.3) reflects bounded confidentiality and integrity impact with no scope change. Publicly available exploit code exists - including a publicly shared proof-of-concept file - but attackers must first hold a valid account on the affected system, and the vendor was contacted about the disclosure without responding, so no patch is currently available.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privileged user with network access to retrieve sensitive data via the /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload endpoint. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS 3.1 impact is limited to low confidentiality loss with no integrity or availability effect. The practical risk is low-to-medium, driven by the public exploit and the need for a valid account.
Path traversal in the Scorecard.jsp endpoint of Eleveo Quality Management 9.7.0 allows an authenticated remote attacker with a valid low-privilege session to escape the intended audio-upload directory of the Questionnaire Audio Upload component and read or write files within the web server's access rights. Publicly available exploit code exists, including a proof-of-concept archive linked from the disclosure, so the technique is reproducible by anyone who can first obtain application credentials; there is no CISA KEV listing or other confirmation of active exploitation. Impact is bounded to low confidentiality, integrity, and availability rather than remote code execution, and the vendor was contacted about the disclosure but did not respond.
Reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 lets an attacker inject script through the viewRoleId or cfType parameter of the Play Audio Page endpoint /callrec/audio.jsp, executing in the browser of any user who opens a crafted link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, base 5.1) shows the attack is network-reachable but constrained: a low-privilege authenticated account is required and a legitimate user must interact with the link, so it is neither unauthenticated nor zero-click, and the assessed impact is limited to integrity (VI:L) with no confidentiality or availability effect recorded. Publicly available exploit code exists and the vendor did not respond to disclosure, so no patched version is available and deployed 9.7.0 instances remain exposed.
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.
Stored or reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 allows an authenticated low-privilege user to inject arbitrary client-side script via the name or username parameter of the /callrec/roleAddAction.do endpoint. When a victim user - likely an administrator viewing role management pages - loads the affected page, the injected payload executes in their browser context. A public proof-of-concept exploit exists on Google Drive; the vendor did not respond to responsible disclosure, so no patch has been issued.
Improper authorization in Eleveo Call Recording Software 9.7.0 enables remote authenticated attackers to access call recordings they are not permitted to view by manipulating the `callId` parameter in the `/callrec/audio.jsp` endpoint. The flaw follows a classic Insecure Direct Object Reference (IDOR) pattern under CWE-285, where the application fails to enforce per-user ownership checks on recording identifiers. A public exploit has been released and no vendor patch exists - the vendor did not respond to responsible disclosure - making compensating controls the only available mitigation at this time.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to perform unauthorized operations on the Recorded Calls Page via the `/callrec/restoreCallAction.do` endpoint, potentially accessing or restoring call recordings outside their permitted scope. The vulnerability stems from CWE-285 (Improper Authorization), meaning the application fails to enforce access controls on the restore call action, permitting privilege escalation within the recording management interface. A publicly available proof-of-concept exploit exists per the CVSS 4.0 E:P supplemental metric; no patch has been confirmed by the vendor, who did not respond to disclosure attempts.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to bypass access controls on the /callrec/composeEmailAction.do endpoint, exposing limited confidential data. The flaw (CWE-285) means the application fails to enforce authorization decisions for at least one action reachable by low-privileged authenticated users. A publicly available proof-of-concept exploit has been disclosed via VulDB, and no vendor patch exists - the vendor did not respond to the coordinated disclosure. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), though exploit code exists.
Improper authorization on the /callrec/pci_dss_status.jsp endpoint in Eleveo Call Recording Software 9.7.0 allows authenticated low-privilege users to access PCI DSS compliance status data they are not authorized to view. The exposed information reveals the payment card compliance posture of the organization, which could be leveraged to identify exploitable compliance gaps and inform targeted attacks against payment infrastructure. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving no official patch or advisory available.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to access the /callrec/group.jsp endpoint without proper permission checks, resulting in unauthorized read access to call recording group data. A publicly available exploit has been disclosed via Google Drive; the vendor was notified but did not respond, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis is superseded here - a public POC exists (E:P in the CVSS 4.0 vector), though this is not confirmed actively exploited (CISA KEV) and the CVSS 4.0 score of 2.1 reflects limited scope impact.
Improper authorization in Eleveo Call Recording Software 9.7.0 exposes the /callrec/sendlogfile endpoint to low-privileged authenticated remote attackers, enabling unauthorized access to log file functionality with confirmed confidentiality impact. The flaw (CWE-285) stems from missing or bypassable authorization checks on a sensitive operational endpoint within the call recording platform. A publicly available proof-of-concept exploit exists, and the vendor failed to respond to coordinated disclosure - no patch has been released.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated users to access the /callrec/statisticReportAction.do endpoint beyond their privilege level, enabling unauthorized read, write, and availability impact on sensitive call statistics and reporting data. The vendor was notified but did not respond, leaving version 9.7.0 unpatched. A proof-of-concept exploit is publicly available, raising immediate risk for any organization running this version of the software.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows low-privileged authenticated remote users to bypass access controls on the LDAP User Interface endpoint `/callrec/users_ldap.jsp`, exposing restricted LDAP directory user data without appropriate privilege verification. A public proof-of-concept exploit has been disclosed via Google Drive and the vendor has not responded to responsible disclosure, leaving no official patch or advisory available. The CVSS 4.0 base score of 2.1 reflects narrow confidentiality-only impact, but POC availability and vendor silence increase practical urgency for affected deployments.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated low-privileged users to manipulate the role and group management endpoint (/callrec/roleAddAction.do), bypassing access controls without proper privilege checks. A publicly available exploit exists for this flaw, raising practical risk despite the relatively low CVSS 4.0 score of 2.1 (inflated downward by the E:P threat metric). The vendor was unresponsive to coordinated disclosure, meaning no official patch or acknowledgment exists at time of analysis.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote low-privileged users to manipulate the 'role' parameter in the /callrec/userAddAction.do endpoint, potentially enabling unauthorized role assignment during user creation. The vulnerability carries a CVSS 4.0 score of 2.1 with low-impact metrics across confidentiality, integrity, and availability, though the real-world risk of privilege escalation through role manipulation may be underrepresented by that score. A proof-of-concept exploit is publicly available; no vendor patch exists as the vendor did not respond to responsible disclosure.
Insufficient session expiration in Eleveo Call Recording Software (versions up to and including 10.3.0) leaves the Keycloak OpenID Connect logout endpoint at /auth/realms/default/protocol/openid-connect/logout unable to fully invalidate session state, so a session can persist after a user believes they have logged out (CWE-613). Exploitation requires an attacker to already hold a low-privileged authenticated account (PR:L) and depends on passive user interaction (UI:P), such as a victim performing or relying on a logout action; the resulting impact is limited to minor confidentiality exposure (VC:L) with no integrity or availability effect. Publicly available exploit code exists, no confirmed active exploitation has been reported, and with a CVSS 4.0 base score of 2.0 this is a genuinely low-priority issue despite being remotely reachable.
Eleveo Call Recording Software up to 10.3.0 transmits the OpenID Connect id_token_hint JWT as a GET query-string parameter on its logout endpoint (/auth/realms/default/protocol/openid-connect/logout), allowing that token to be captured from browser history, referrer headers, proxy caches, or server access logs. Exploitation is remote but constrained: the CVSS vector indicates a low-privileged authenticated context (PR:L), passive user interaction (UI:P), and high attack complexity (AC:H), with the vendor itself stating exploitability is difficult, and impact limited to low confidentiality disclosure of the token - no integrity or availability effect. Publicly available exploit code exists and the disclosure has been published, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall CVSS base score is only 1.2, making this a very low-priority issue.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privilege remote attacker to read sensitive data via the createAndSaveAudit function of the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. Publicly available exploit code exists, but exploitation requires a valid session and network access to the web tier, and the impact is limited to confidentiality with no integrity or availability effect. No vendor patch has been identified; the vendor did not respond to the disclosure.
LDAP injection in Eleveo Call Recording Software 9.7.0 lets an authenticated, low-privileged user manipulate the Username argument of the User Management endpoint /callrec/userAddAction.do so that unsanitized input is incorporated into an LDAP directory query, resulting in low-impact disclosure of directory information. The attack is reachable remotely and requires no user interaction, but it is gated behind a valid low-privilege account and a deployment whose user management is backed by an LDAP directory. Publicly available exploit code exists, including a proof-of-concept linked from the VulDB disclosure, and the vendor was contacted but did not respond; EPSS and CISA KEV do not indicate confirmed active exploitation. With a CVSS 5.3 base score and confidentiality-only impact (C:L, no integrity or availability effect), this is a high-CVSS-appearance-but-modest-real-risk issue.
Improper access control in Eleveo Call Recording Software 9.7.0 allows a low-privilege authenticated user to exercise functionality reachable through the Query Builder endpoint /callrec/searchAction.do that should require higher privileges, resulting in limited unauthorized read and manipulation of call-recording data. The flaw is remotely reachable over the web interface with low attack complexity and no user interaction, and the assessed vector (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CVSS 4.0 base 5.3) reflects bounded confidentiality and integrity impact with no scope change. Publicly available exploit code exists - including a publicly shared proof-of-concept file - but attackers must first hold a valid account on the affected system, and the vendor was contacted about the disclosure without responding, so no patch is currently available.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privileged user with network access to retrieve sensitive data via the /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload endpoint. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS 3.1 impact is limited to low confidentiality loss with no integrity or availability effect. The practical risk is low-to-medium, driven by the public exploit and the need for a valid account.
Path traversal in the Scorecard.jsp endpoint of Eleveo Quality Management 9.7.0 allows an authenticated remote attacker with a valid low-privilege session to escape the intended audio-upload directory of the Questionnaire Audio Upload component and read or write files within the web server's access rights. Publicly available exploit code exists, including a proof-of-concept archive linked from the disclosure, so the technique is reproducible by anyone who can first obtain application credentials; there is no CISA KEV listing or other confirmation of active exploitation. Impact is bounded to low confidentiality, integrity, and availability rather than remote code execution, and the vendor was contacted about the disclosure but did not respond.
Reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 lets an attacker inject script through the viewRoleId or cfType parameter of the Play Audio Page endpoint /callrec/audio.jsp, executing in the browser of any user who opens a crafted link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, base 5.1) shows the attack is network-reachable but constrained: a low-privilege authenticated account is required and a legitimate user must interact with the link, so it is neither unauthenticated nor zero-click, and the assessed impact is limited to integrity (VI:L) with no confidentiality or availability effect recorded. Publicly available exploit code exists and the vendor did not respond to disclosure, so no patched version is available and deployed 9.7.0 instances remain exposed.
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.
Stored or reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 allows an authenticated low-privilege user to inject arbitrary client-side script via the name or username parameter of the /callrec/roleAddAction.do endpoint. When a victim user - likely an administrator viewing role management pages - loads the affected page, the injected payload executes in their browser context. A public proof-of-concept exploit exists on Google Drive; the vendor did not respond to responsible disclosure, so no patch has been issued.
Improper authorization in Eleveo Call Recording Software 9.7.0 enables remote authenticated attackers to access call recordings they are not permitted to view by manipulating the `callId` parameter in the `/callrec/audio.jsp` endpoint. The flaw follows a classic Insecure Direct Object Reference (IDOR) pattern under CWE-285, where the application fails to enforce per-user ownership checks on recording identifiers. A public exploit has been released and no vendor patch exists - the vendor did not respond to responsible disclosure - making compensating controls the only available mitigation at this time.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to perform unauthorized operations on the Recorded Calls Page via the `/callrec/restoreCallAction.do` endpoint, potentially accessing or restoring call recordings outside their permitted scope. The vulnerability stems from CWE-285 (Improper Authorization), meaning the application fails to enforce access controls on the restore call action, permitting privilege escalation within the recording management interface. A publicly available proof-of-concept exploit exists per the CVSS 4.0 E:P supplemental metric; no patch has been confirmed by the vendor, who did not respond to disclosure attempts.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to bypass access controls on the /callrec/composeEmailAction.do endpoint, exposing limited confidential data. The flaw (CWE-285) means the application fails to enforce authorization decisions for at least one action reachable by low-privileged authenticated users. A publicly available proof-of-concept exploit has been disclosed via VulDB, and no vendor patch exists - the vendor did not respond to the coordinated disclosure. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), though exploit code exists.
Improper authorization on the /callrec/pci_dss_status.jsp endpoint in Eleveo Call Recording Software 9.7.0 allows authenticated low-privilege users to access PCI DSS compliance status data they are not authorized to view. The exposed information reveals the payment card compliance posture of the organization, which could be leveraged to identify exploitable compliance gaps and inform targeted attacks against payment infrastructure. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving no official patch or advisory available.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to access the /callrec/group.jsp endpoint without proper permission checks, resulting in unauthorized read access to call recording group data. A publicly available exploit has been disclosed via Google Drive; the vendor was notified but did not respond, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis is superseded here - a public POC exists (E:P in the CVSS 4.0 vector), though this is not confirmed actively exploited (CISA KEV) and the CVSS 4.0 score of 2.1 reflects limited scope impact.
Improper authorization in Eleveo Call Recording Software 9.7.0 exposes the /callrec/sendlogfile endpoint to low-privileged authenticated remote attackers, enabling unauthorized access to log file functionality with confirmed confidentiality impact. The flaw (CWE-285) stems from missing or bypassable authorization checks on a sensitive operational endpoint within the call recording platform. A publicly available proof-of-concept exploit exists, and the vendor failed to respond to coordinated disclosure - no patch has been released.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated users to access the /callrec/statisticReportAction.do endpoint beyond their privilege level, enabling unauthorized read, write, and availability impact on sensitive call statistics and reporting data. The vendor was notified but did not respond, leaving version 9.7.0 unpatched. A proof-of-concept exploit is publicly available, raising immediate risk for any organization running this version of the software.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows low-privileged authenticated remote users to bypass access controls on the LDAP User Interface endpoint `/callrec/users_ldap.jsp`, exposing restricted LDAP directory user data without appropriate privilege verification. A public proof-of-concept exploit has been disclosed via Google Drive and the vendor has not responded to responsible disclosure, leaving no official patch or advisory available. The CVSS 4.0 base score of 2.1 reflects narrow confidentiality-only impact, but POC availability and vendor silence increase practical urgency for affected deployments.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated low-privileged users to manipulate the role and group management endpoint (/callrec/roleAddAction.do), bypassing access controls without proper privilege checks. A publicly available exploit exists for this flaw, raising practical risk despite the relatively low CVSS 4.0 score of 2.1 (inflated downward by the E:P threat metric). The vendor was unresponsive to coordinated disclosure, meaning no official patch or acknowledgment exists at time of analysis.
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote low-privileged users to manipulate the 'role' parameter in the /callrec/userAddAction.do endpoint, potentially enabling unauthorized role assignment during user creation. The vulnerability carries a CVSS 4.0 score of 2.1 with low-impact metrics across confidentiality, integrity, and availability, though the real-world risk of privilege escalation through role manipulation may be underrepresented by that score. A proof-of-concept exploit is publicly available; no vendor patch exists as the vendor did not respond to responsible disclosure.