메뉴 건너뛰기

GREATUSER

cve

CVE-2017-16606

관리자 2018.01.25 04:00 조회 수 : 11

This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp._3d.add_005f3d_005fview_005fdo_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5197.


원문출처 : https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16606
번호 제목 글쓴이 날짜 조회 수
452 CVE-2018-1000010 관리자 2018.01.25 11
451 CVE-2018-1000009 관리자 2018.01.25 11
450 CVE-2018-1000008 관리자 2018.01.25 11
449 CVE-2017-16610 관리자 2018.01.25 11
» CVE-2017-16606 관리자 2018.01.25 11
447 CVE-2018-6001 관리자 2018.01.25 11
446 CVE-2018-1000003 관리자 2018.01.25 11
445 CVE-2018-1044 관리자 2018.01.25 11
444 CVE-2017-12116 관리자 2018.01.25 11
443 CVE-2018-5783 관리자 2018.01.25 11
442 CVE-2017-16645 관리자 2017.11.09 11
441 CVE-2017-14115 관리자 2017.09.04 11
440 CVE-2017-12707 관리자 2017.08.27 11
439 CVE-2017-9506 관리자 2017.08.27 11
438 CVE-2017-7410 관리자 2017.04.04 11
위로