Quality Management
Monthly
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privilege remote attacker to read sensitive data via the createAndSaveAudit function of the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. Publicly available exploit code exists, but exploitation requires a valid session and network access to the web tier, and the impact is limited to confidentiality with no integrity or availability effect. No vendor patch has been identified; the vendor did not respond to the disclosure.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privileged user with network access to retrieve sensitive data via the /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload endpoint. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS 3.1 impact is limited to low confidentiality loss with no integrity or availability effect. The practical risk is low-to-medium, driven by the public exploit and the need for a valid account.
Path traversal in the Scorecard.jsp endpoint of Eleveo Quality Management 9.7.0 allows an authenticated remote attacker with a valid low-privilege session to escape the intended audio-upload directory of the Questionnaire Audio Upload component and read or write files within the web server's access rights. Publicly available exploit code exists, including a proof-of-concept archive linked from the disclosure, so the technique is reproducible by anyone who can first obtain application credentials; there is no CISA KEV listing or other confirmation of active exploitation. Impact is bounded to low confidentiality, integrity, and availability rather than remote code execution, and the vendor was contacted about the disclosure but did not respond.
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privilege remote attacker to read sensitive data via the createAndSaveAudit function of the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. Publicly available exploit code exists, but exploitation requires a valid session and network access to the web tier, and the impact is limited to confidentiality with no integrity or availability effect. No vendor patch has been identified; the vendor did not respond to the disclosure.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privileged user with network access to retrieve sensitive data via the /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload endpoint. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the assessed CVSS 3.1 impact is limited to low confidentiality loss with no integrity or availability effect. The practical risk is low-to-medium, driven by the public exploit and the need for a valid account.
Path traversal in the Scorecard.jsp endpoint of Eleveo Quality Management 9.7.0 allows an authenticated remote attacker with a valid low-privilege session to escape the intended audio-upload directory of the Questionnaire Audio Upload component and read or write files within the web server's access rights. Publicly available exploit code exists, including a proof-of-concept archive linked from the disclosure, so the technique is reproducible by anyone who can first obtain application credentials; there is no CISA KEV listing or other confirmation of active exploitation. Impact is bounded to low confidentiality, integrity, and availability rather than remote code execution, and the vendor was contacted about the disclosure but did not respond.
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.
An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.