Remote Information Disclosure Vulnerability in NetGain Systems Enterprise Manager

CVE-2017-16595

What is CVE-2017-16595?

A vulnerability present in NetGain Systems Enterprise Manager 7.2.730 build 1034 poses a risk of remote information disclosure. While authentication is typically required, the authentication mechanism can be circumvented by an attacker. The vulnerability is linked to improper validation of user-supplied parameters within the org.apache.jsp.u.jsp.reports.export_005fdownload_jsp servlet, which operates on TCP port 8081 by default. By exploiting this flaw, an attacker could potentially gain unauthorized access to sensitive information and could even exploit it alongside other vulnerabilities to execute arbitrary code with Administrator privileges.

References