File Deletion Vulnerability in NetGain Systems Enterprise Manager
CVE-2017-16593

6.5MEDIUM

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16593?

A security flaw in NetGain Systems Enterprise Manager allows remote attackers to exploit authentication mechanisms to delete arbitrary files. This occurs due to inadequate validation of user-supplied paths in the file deletion servlet, enabling file operations on any files accessible to the Administrator user. Attackers can leverage this vulnerability to manipulate critical system files, posing significant risks to data integrity and system security.

Affected Version(s)

NetGain Systems Enterprise Manager 7.2.730 build 1034

References

https://zerodayinitiative.com/advisories/ZDI-17-958
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.