File Upload Vulnerability in NetGain Systems Enterprise Manager
CVE-2017-16594

6.5MEDIUM

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16594?

This vulnerability enables remote attackers to upload arbitrary files on systems running vulnerable versions of NetGain Systems Enterprise Manager. Despite requiring authentication, the flawed mechanism allows attackers to bypass authentication and exploit the service. The issue lies within a servlet that does not correctly validate user input, particularly within the id parameter. This oversight could lead to severe security risks, including the potential execution of code with Administrator privileges on compromised systems.

Affected Version(s)

NetGain Systems Enterprise Manager 7.2.730 build 1034

References

https://zerodayinitiative.com/advisories/ZDI-17-959
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.