Genesys Cloud - Main

 View Only
Discussion Thread View
  • 1.  Purecloud Supervisor App accessible by anyone with a username in your org

    Posted 04-04-2019 01:14
    Hi All

    I thought i would bring it to your attention that we have identified a bug/issue with the Purecloud Supervisor App available on the Apple App Store.
    This for some if not all of you may see this as a breach of privacy for your organisations.

    I used a basic user permission and download the app to ipad, although it tells me I am unable to access the app it still allows it to look at the whole organisational queues the activities of all agents, there statistics and measures, whos on calls, what calls are in queue and many other things that you would think an agent can't do without the correct permissions. Part Telephone numbers can be seen also.

    While this may be low impacting for some of you I see this as a breach.

    Might be worth you checking from your orgs too, the unfortunate thing is though we will never know who can see this detail as user information from the app is not available to orgs.

    I have raised a ticket with support but as its under assessment need to wait

    #DigitalChannels
    #Security
    #Unsure/Other

    ------------------------------
    Darryn Chang
    Stuff Limited
    New Zealand
    2 Years Purecloud
    ------------------------------


  • 2.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    GENESYS
    Posted 04-04-2019 15:05

    Darryn -

    Can you provide me the case # please?  

    We'll be updating the app to leverage the same permissions as the WebUI.  Expected release is mid-April.



    ------------------------------
    Darlene Oordt
    Sr Director, Product Management
    Genesys - Employees
    ------------------------------



  • 3.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    Posted 04-04-2019 17:09
    Hi Darlene

    Case #0002511923

    Unfortunately it seems the case manager didn't give it a try and has provided a generic response putting back to permissions, which is unfortunate that i know its not permission based.
    While it loads a message, advising you don't have permission to access the different views that's merely smoke and mirrors.

    I also came across a post from last year https://community.genesys.com/communities/community-home/digestviewer/viewthread?GroupId=19&MessageKey=391e7214-f209-4ca2-9fdf-b7393618421e&CommunityKey=bab95e9c-6bbe-4a13-8ade-8ec0faf733d4&tab=digestviewer

    So interestingly although the post states you need supervisor permission you actually don't even need a license to get the active views. Which for us is great no cost but also means its a loss for Genesys by missing out on fees.

    Glad to hear there is work in progress to update the permissions to reflect what can be accessed. I look forward to the release


    ------------------------------
    Darryn Chang
    Stuff Limited
    New Zealand
    2 Years Purecloud
    ------------------------------



  • 4.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    GENESYS
    Posted 04-05-2019 11:56
    Darryn

    Thanks for the case # - I've asked the care team to take another look and to link your ticket to the development ticket that we have tracking this work.

    Thanks again!
    Darlene ​

    ------------------------------
    Darlene Oordt
    Sr Director, Product Management
    Genesys - Employees
    ------------------------------



  • 5.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    GENESYS
    Posted 04-05-2019 10:47
    Hi Darryn,

    When you say you "used a basic user permission," can you elaborate? The PureCloud API requires a different permission for every piece of data you can view or modify. So if you can see queues, for example, your user must have the specific permission to view queues. Likewise, there is a separate permission for viewing the different statistics and conversations. So, while the supervisor app itself may not gate its features based on a user's permission, the PureCloud API absolutely does, and no user should see data he or she does not have permission to view.

    I suspect that the user you were logged-in as DID have permission to view the data you saw.

    ------------------------------
    Anthony Alford
    Genesys
    ------------------------------



  • 6.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    GENESYS
    Posted 04-08-2019 14:03
    @Darryn Chang I have the PureCLoud Supervisor app on my iPad, and when I log into our corporate organization (where I am just a business user, Communicate license, no Contact Center or supervisory permissions) I cannot see any data for queues or other users or much of anything. I can install the app, but can't see data. ​

    ------------------------------
    George Ganahl CCXP, GCA
    Principal Technology Consultant
    Genesys
    ------------------------------



  • 7.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    Posted 04-16-2019 00:35
    Thanks @George Ganahl and @Anthony Alford. I have had to filter through and test which permission is authorizing the content to be accessible.
    While I only have the default Employee, Purecloud Agent, Outbound Agent roles assigned to agents. I am suspecting its the Conversations>Aggregates permission allowing the queue information and details to be visible to agents via the Ipad App. As this removes the Performance Tab from the Overview for agents. Which they do need access to.
    Besides limiting the option to agents from selecting which queue they are allowed to view, there hasn't been any other authorizations.

    Trial and error at the moment testing which permissions is permitting this.​​

    ------------------------------
    Darryn Chang
    Stuff Limited
    New Zealand
    2 Years Purecloud
    ------------------------------



  • 8.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    Posted 04-29-2019 01:56
    Support advised that the App on IPAD was updated. I can confirm Agents are no longer able to see the Supervisor details.

    ------------------------------
    Darryn Chang
    Stuff Limited
    New Zealand
    2 Years Purecloud
    ------------------------------



  • 9.  RE: Purecloud Supervisor App accessible by anyone with a username in your org

    GENESYS
    Posted 04-29-2019 11:35
    Thanks for the update Darryn.

    ------------------------------
    Darlene Oordt
    Sr Director, Product Management
    Genesys - Employees
    ------------------------------



Need Help finding something?

Check out the Genesys Knowledge Network - your all-in-one access point for Genesys resources