Information Disclosure Vulnerability in Netgain Enterprise Manager
CVE-2017-16609

7.5HIGH

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16609?

The vulnerability allows remote attackers to disclose sensitive information on installations of Netgain Enterprise Manager due to inadequate validation of user-supplied input in the download.jsp component. By exploiting this flaw, attackers can potentially uncover sensitive data without requiring authentication, making it critical for affected users to apply necessary mitigation strategies immediately.

Affected Version(s)

NetGain Systems Enterprise Manager v7.2.586 build 877

References

https://zerodayinitiative.com/advisories/ZDI-17-951
x_refsource_MISC
https://www.tenable.com/security/research/tra-2018-02
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.