This vulnerability in Eleveo Quality Management 9.7.0 involves the UtilsService.createAndSaveAudit function in the /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService component. A remote attacker can manipulate this function via the GWT RPC Handler to cause information disclosure. The issue is confirmed to be exploitable remotely without user interaction and requires low attack complexity and low privileges. The vendor was notified but has not provided a response or fix. Public exploit code is available, which may facilitate attacks.

Successful exploitation results in unauthorized disclosure of information from the affected Eleveo Quality Management system. This could lead to exposure of sensitive audit data or other internal information handled by the UtilsService.createAndSaveAudit function. The vulnerability does not allow privilege escalation, denial of service, or code execution based on the available data.

No official patch or remediation has been provided by the vendor as of the publication date. Since the vendor has not responded and no fix is available, organizations should consider applying compensating controls such as restricting network access to the affected service and monitoring for suspicious activity related to the UtilsService.createAndSaveAudit function. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.