Remote Code Execution Vulnerability in Netgain Enterprise Manager
CVE-2017-16610

9.8CRITICAL

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16610?

A vulnerability exists in the Netgain Enterprise Manager that enables remote attackers to execute arbitrary code without authentication. This problem is rooted in the upload_save_do.jsp component, where insufficient validation of user-supplied paths allows an attacker to manipulate file operations. Through exploitation, attackers can execute code in the context of the current user, potentially compromising the system's integrity. Proper security measures should be implemented to mitigate this risk.

Affected Version(s)

NetGain Systems Enterprise Manager v7.2.586 build 877

References

https://zerodayinitiative.com/advisories/ZDI-17-952
x_refsource_MISC
https://www.tenable.com/security/research/tra-2018-02
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.