CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://blogs.securiteam.com/index.php/archives/3228	Exploit Patch Third Party Advisory
https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.2:12200:*:*:*:*:*:*

History

No history.

Information

Published : 2017-09-04 20:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-14123

Mitre link : CVE-2017-14123

CVE.ORG link : CVE-2017-14123

JSON object : View

Products Affected

zohocorp

manageengine_firewall_analyzer

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2017-14123", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-09-04T20:29:00.197", "references": [{"url": "https://blogs.securiteam.com/index.php/archives/3228", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the \"Group Chat\" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp."}, {"lang": "es", "value": "Zoho ManageEngine Firewall Analyzer 12200 tiene una vulnerabilidad de subida de archivos sin restricci\u00f3n en la secci\u00f3n \"Group Chat\". Cualquier usuario podr\u00eda subir archivos con cualquier extensi\u00f3n. Al subir un archivo PHP al servidor, un atacante podr\u00eda hacer que se ejecute en el contexto del servidor, tal y como se puede ver en /itplus/FileStorage/302/shell.jsp."}], "lastModified": "2020-10-01T17:51:31.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.2:12200:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05955BD9-919D-4088-BD16-0C3BB81F354B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}