What’s Vulnerable › Vulnerabilities

CVE-2018-17287

• Severity: medium (CVSS 4.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-18 · updated 2026-06-17
• Weakness: CWE-311

Description

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end "download" feature, as demonstrated by an mfp.password downloadsettingvalue operation.

Affected products

• Kofax Front Office Server: 4.1.1.11.0.5212

References

• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17287-Information%20Disclosure-Kofax
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17287-Information%20Disclosure-Kofax

Get alerted when CVE-2018-17287 or the next vulnerability affects your stack