| Título | Eleveo Quality Management 9.7.0 Information Disclosure |
|---|
| Descrição | An Information Disclosure vulnerability exists in the /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload endpoint of Eleveo Quality Management 9.7.0, allowing authenticated users to obtain sensitive internal filesystem information. When exporting a questionnaire as an XML file, the generated output includes backend-specific details within attributes, which disclose the full filesystem path of the application’s deployment, including the web root and the location of the Scorecard QM service JAR file. This exposure of internal paths can aid attackers in crafting further targeted attacks.
Impact
• Exposure of internal paths may occur, revealing the web root and application directory structure.
• Increased attack surface may result from disclosing deployment details and application components.
• Facilitation of further attacks may occur by enabling attackers to craft precise payloads targeting known paths.
• Information leakage may assist in identifying technologies and frameworks used by the application.
PoC
Comprehensive reproduction steps, including supporting screenshots, are available via the shared private link. Public disclosure will occur on GitHub after the responsible disclosure period of approximately 90 days has elapsed.
Note
Contact with the vendor was initiated on April 5, and no response has been received as of the submission date. The provided PoC is accessible via a restricted link and is intended solely for review purposes by anyone possessing the link. I plan to reserve a CVE early, with public disclosure scheduled after 90 days from the initial contact date, at which point the advisory will be published on my GitHub repository. The information shared here is provided exclusively to the VulnDB team to ensure awareness and understanding of the vulnerability details. |
|---|
| Fonte | ⚠️ https://drive.google.com/file/d/1qKulZLn6xxT3ePlV__Q-0MKLhlWmRI_U/view?usp=sharing |
|---|
| Utilizador | omarelshopky (UID 85487) |
|---|
| Submissão | 18/07/2026 14h57 (há 2 meses) |
|---|
| Moderação | 28/09/2026 10h11 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 410995 [Eleveo Quality Management 9.7.0 QMBODownload Divulgação de Informação] |
|---|
| Pontos | 20 |
|---|