Information Disclosure Vulnerability in NetGain Systems Enterprise Manager
CVE-2017-16591

6.5MEDIUM

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16591?

This vulnerability permits remote attackers to leak sensitive information from affected installations of NetGain Systems Enterprise Manager. While authentication is needed to exploit the flaw, the authentication mechanism can be circumvented. The issue resides in the org.apache.jsp.u.jsp.restore.download_005fdo_jsp servlet on TCP port 8081. The flaw occurs due to improper validation of user-supplied paths in file operations, allowing attackers to exploit this weakness in conjunction with other vulnerabilities to execute code with Administrator privileges.

Affected Version(s)

NetGain Systems Enterprise Manager 7.2.699 build 1001

References

https://zerodayinitiative.com/advisories/ZDI-17-956
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.