Remote Code Execution Vulnerability in Artica Web Proxy by Artica Networks
CVE-2017-17055

9CRITICAL

Key Information:

Vendor

Articatech

Status
Artica Proxy
Vendor
CVE Published:
7 December 2017

What is CVE-2017-17055?

The Artica Web Proxy prior to version 3.06.112911 is vulnerable to a remote code execution flaw that allows attackers to execute arbitrary code with root privileges. This vulnerability is exploited via a cross-site scripting (XSS) attack that involves manipulating the username-form-id parameter in the freeradius.users.php script. Attackers can leverage this security weakness to gain unauthorized access and control over the affected system.

References

http://seclists.org/fulldisclosure/2017/Dec/3
mailing-listx_refsource_FULLDISC
http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PRO...
x_refsource_MISC
https://www.exploit-db.com/exploits/43206/
exploitx_refsource_EXPLOIT-DB

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.