메뉴 건너뛰기

GREATUSER

cve

CVE-2017-16603

관리자 2018.01.25 04:00 조회 수 : 57

This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.settings.upload_005ffile_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate user-supplied data, which can allow for the upload of files. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5194.


원문출처 : https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16603
번호 제목 글쓴이 날짜 조회 수
» CVE-2017-16603 관리자 2018.01.25 57
31 CVE-2017-16600 관리자 2018.01.25 57
30 CVE-2018-6010 관리자 2018.01.25 58
29 CVE-2018-0845 관리자 2018.01.25 58
28 CVE-2018-0848 관리자 2018.01.25 63
27 CVE-2018-6000 관리자 2018.01.25 64
26 CVE-2017-12084 관리자 2017.11.09 71
25 CVE-2017-9507 관리자 2017.08.27 80
24 CVE-2017-16595 관리자 2018.01.25 115
23 CVE-2017-16605 관리자 2018.01.25 116
22 CVE-2017-16594 관리자 2018.01.25 126
21 CVE-2018-6022 관리자 2018.01.25 137
20 CVE-2018-6013 관리자 2018.01.25 141
19 CVE-2018-6009 관리자 2018.01.25 142
18 CVE-2017-12085 관리자 2017.11.09 158
위로