Brute-force attack in Fiserv web platform

Published: 2018-08-29
Risk Low
Patch available NO
Number of vulnerabilities 1
Exploitation vector Network
Public exploit N/A
Vulnerable software
Fiserv web platform
Web applications / Other software

Vendor Fiserv

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Brute-force attack

EUVDB-ID: #VU14559

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:U/RL:U/RC:C]


CWE-ID: CWE-200 - Information exposure

Exploit availability: No


The vulnerability allows a remote attacker to conduct brute-force attack on the target system.

The vulnerability exists due to use of a specific “event number" in the operation alerts. A remote attacker can conduct brute-force attack, gain access to the victims' data and potentially modify or delete important information, as phone numbers and email addresses.


Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

Vulnerable software versions

Fiserv web platform: All versions

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.