File Overwrite Vulnerability in NetGain Systems Enterprise Manager by NetGain Systems
CVE-2017-16604

6.5MEDIUM

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16604?

This vulnerability enables remote attackers to overwrite arbitrary files on installations of NetGain Systems Enterprise Manager. Although it requires authentication, the flawed authentication mechanism can be bypassed. Specifically, the issue lies within a servlet that fails to properly validate user-supplied filenames before executing file operations. An attacker could exploit this oversight to overwrite files accessible to the Administrator, potentially compromising system integrity.

Affected Version(s)

NetGain Systems Enterprise Manager 7.2.730 build 1034

References

https://zerodayinitiative.com/advisories/ZDI-17-969
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.