Sensitive Information Disclosure in NetGain Systems Enterprise Manager

CVE-2017-16592

What is CVE-2017-16592?

This vulnerability permits remote attackers to access sensitive information from vulnerable instances of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although some form of authentication is necessary for exploitation, the existing authentication mechanism is flawed and can be circumvented. The vulnerability is rooted in the common.download_jsp servlet, which defaults to TCP port 8081. The issue arises during the handling of the filename parameter where inadequate validation of user-supplied paths allows attackers to manipulate file operations. Exploiting this can enable code execution within the context of an Administrator, especially when combined with other vulnerabilities.

References