CyberRota Analysis
AI-GeneratedThe Eleveo Call Recording Software versions up to 10.3.0 are vulnerable due to a flaw in the JWT Token Handler, specifically in the handling of the `id_token_hint` argument within the logout process. This vulnerability could allow an attacker to manipulate requests and potentially expose sensitive query strings, although the complexity of the attack is high and exploitability is considered difficult. Organizations using this software should prioritize addressing this issue, especially if they handle sensitive data, as the exploit has been publicly disclosed.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.