Security readout for executives and security teams
Plain-English summary
MetInfo through 5.3.17 reused a valid CAPTCHA answer for up to 120 seconds. That weakens protections on login and password-recovery pages, making automated abuse easier if an attacker can replay or alter client-server traffic.
Executive priority
Treat this as a moderate authentication-abuse risk for exposed MetInfo sites. Prioritize inventory and vendor-guided remediation where MetInfo is public-facing or protects sensitive accounts.
Technical view
The CVE describes a CAPTCHA validation weakness in MetInfo through 5.3.17. The same CAPTCHA response remains accepted for 120 seconds, demonstrated on login/findpass pages. The public record provides no CVSS score, CWE, confirmed patch version, or vendor mitigation details.
Likely exposure
Exposure is likely limited to internet-facing MetInfo sites running version 5.3.17 or earlier, especially deployments exposing CAPTCHA-protected login or password-recovery workflows.
Exploitation context
The source bundle does not show KEV listing or confirmed active exploitation. The described issue is remotely useful for weakening CAPTCHA challenge requirements, but the available evidence is incomplete.
Researcher notes
Evidence is sparse: the CVE names MetInfo through 5.3.17 and describes CAPTCHA reuse, but provides no CVSS, CWE, fixed release, or exploitation confirmation. Avoid assuming broader product impact.
Mitigation direction
- Inventory MetInfo installations and identify any running version 5.3.17 or earlier.
- Check MetInfo vendor guidance for fixed versions or official mitigation advice.
- Harden login and password-recovery flows with rate limits and abuse monitoring.
- Review authentication logs for repeated CAPTCHA reuse patterns or recovery-page abuse.
Validation and detection
- Confirm the MetInfo version on all public and internal deployments.
- Verify login and findpass pages do not accept reused CAPTCHA responses.
- Check whether CAPTCHA tokens expire immediately after successful validation.
- Review logs around authentication and password-recovery endpoints for automation indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11717 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://lncken.cn/?p=343CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.