Vulnerable Software: Verint Workforce Optimization (WFO)
Vulnerability: Unauthenticated Information Disclosure via API
Affected Version: 15.1 (15.1.0.37634)
Vendor Homepage: Link
CVE: 2020-23446
CVE Author: Tejas Nitin Pingulkar
Exploit Available: POC Available
About Affected Software:
Verint Workforce Optimization is a suite of unified software and services for capturing interactions and managing the performance of employees across the enterprise or in targeted areas of your business, including:
- Back-office operations
- Branch operations
- Contact centers
- Financial trading rooms
Additional Information:
Verint WFO application provides functionality to download topology reports to authenticated users, However, due to an insecure direct object reference (IDOR) vulnerability in the API, an unauthenticated attacker can obtain reports.
Exploit:
Access URL: [IP/Domain]/wfo/rest/em-api/v1/topology/generation
Note: Only the most recently generated report can be accessed by an attacker
Patch: Patched in version 15.2
POC:
Timeline:
2 May 2019 – Informed about vulnerability to Telligent.
3 May 2019 – Initial response.
3 May 2019 – Vulnerability reported.
3 May 2019 – Telligent forwarded details to WFO team.
7 May 2019 – followup with WFO
9 May 2019 – Telligent team confirmed that they will update soon
21 May 2019 – followup with WFO
21 May 2019 – followup with Telligent Team
21 May 2019 – email acknowledgment from Verint (WFO Team)
29 May 2019 – followup with WFO
29 May 2019 – followup with Telligent Team
29 May 2019 – Telligent Team replied back
30 May to till date – No response from both Team vulnerability was patched in 15.2 but no acknowledgment
17 September 2019- Vulnerability Published
One thought on “Verint: Unauthenticated Information Disclosure via API”