CVE-2017-17707

Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding "CredentialId" value, which uniquely identifies a password safe entry. Since "CredentialId" values are implemented as GUIDs, they are hard to guess. However, if for example an entry's owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants.

• CWE-862

• https://www.profundis-labs.com/advisories/CVE-2017-17707.txtExploit, Third Party Advisory
• https://www.profundis-labs.com/advisories/CVE-2017-17707.txtExploit, Third Party Advisory

Published

Jul 31, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17698Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) h…
• CVE-2017-17699K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL …
• CVE-2017-17700K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL …
• CVE-2017-17701K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL …
• CVE-2017-17703Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Pe…
• CVE-2017-17704A door-unlocking issue was discovered on Software House iSta…
• CVE-2017-17708Because of insufficient authorization checks it is possible …
• CVE-2017-17712The raw_sendmsg() function in net/ipv4/raw.c in the Linux ke…7
• CVE-2017-17713Trape before 2017-11-05 has SQL injection via the /nr red pa…
• CVE-2017-17714Trape before 2017-11-05 has XSS via the /nr red parameter, t…
• CVE-2017-17715The saveFile method in MediaController.java in the Telegram …
• CVE-2017-17716GitLab 9.4.x before 9.4.2 does not support LDAP SSL certific…