Visual Planning 8 Authentication Bypass

Unauthenticated attackers can exploit a weakness in the password reset functionality of the Visual Planning application in order to obtain access to arbitrary user accounts including administrators. In case administrative (in the context of Visual Planning) accounts are compromised, attackers can install malicious modules into the application to take over the application server hosting the Visual Planning application. All versions prior to Visual Planning 8 (Build 240207) are affected.

access accounts administrators application attackers authentication authentication bypass bypass can case compromised context exploit hosting install malicious modules order password password reset planning reset server server hosting unauthenticated weakness