Description

A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T05:17:15.743Z",
  "pubdate": "2026-09-04T05:17:15.743Z",
  "executiveSummary": "Eleveo Quality Management 9.7.0 contains a vulnerability in the Conversation Handler component, specifically within the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint.\nThe vulnerability is classified as an improper input validation issue leading to dynamically-determined object attribute manipulation. This flaw allows an unauthenticated or remote attacker to inject arbitrary data into object properties during the processing of the 'createdBy' argument.\nSuccessful exploitation allows for the alteration of internal object states, potentially resulting in unauthorized data modification, privilege escalation, or integrity compromise of the conversation event stream.\nThe attack is remotely executable without requiring prior authentication, significantly increasing the risk profile for exposed instances.\nDespite being notified, the vendor has not responded or provided a patch. Organizations are advised to implement compensatory controls, such as network-level filtering or input sanitization proxies, to mitigate the risk until an official update is released.",
  "technicalDetails": "The vulnerability resides within the Conversation Handler component, specifically affecting the API endpoint located at /enc-fwk-data/api/v3/conversations/<ID>/events. The root cause is an insecure implementation of data binding or object hydration when processing JSON or form-encoded input sent to the server.\nThe application improperly validates the 'createdBy' argument during the event creation process. Instead of strictly enforcing expected data types or pre-defined schema constraints, the backend performs a direct assignment of input parameters to the object's memory structure. This behavior enables a form of attribute injection, where an attacker can supply crafted input that modifies the internal attributes of the target object during its lifecycle instantiation.\nThe attack flow proceeds as follows: 1) The attacker identifies a target conversation ID and crafts a malicious HTTP POST request to the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint. 2) The attacker inserts a serialized object or key-value pair within the 'createdBy' field that maps to protected or sensitive object properties within the application's runtime environment. 3) The Conversation Handler, failing to implement sufficient input validation or 'allow-listing' of object properties, accepts the untrusted input and attempts to write the provided values into the object instance. 4) This dynamic attribute manipulation overrides or adds properties that the application logic did not intend to expose, effectively altering the state of the conversation event data.\nBecause the input handling logic does not sanitize the input against standard object property injection, an attacker can influence the behavior of the application by modifying critical metadata or state flags. This can lead to unauthorized visibility of private events, the corruption of audit logs, or the manipulation of downstream business logic that relies on the integrity of the 'createdBy' attribute. As the vulnerability is accessible remotely via standard HTTP methods, it requires no specific user interaction or pre-existing elevated privileges, making it highly exploitable for threat actors with network access to the API surface. Given that the exploit methodology has been publicly disclosed, the risk of automated or targeted exploitation is elevated."
}