CVE-2017-16608
NetGain Enterprise Manager exec Command Injection Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within exec.jsp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current user. Was ZDI-CAN-4749.
Netgain Enterprise Manager CVE-2017-16608 Esta vulnerabilidad permite que atacantes remotos ejecuten código arbitrario en instalaciones vulnerables de Netgain Enterprise Manager. No se requiere autenticación para explotar esta vulnerabilidad. Este error en concreto existe en exec.jsp. El problema deriva de la falta de validación correcta de una cadena proporcionada por el usuario antes de emplearla para ejecutar una llamada del sistema. Un atacante podría aprovecharse de esta vulnerabilidad para ejecutar código en el contexto del actual usuario. Anteriormente era ZDI-CAN-4749.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability.
The specific flaw exists within exec.jsp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-06 CVE Reserved
- 2017-12-13 CVE Published
- 2024-08-05 CVE Updated
- 2024-11-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-134: Use of Externally-Controlled Format String
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://www.tenable.com/security/research/tra-2018-02 | Third Party Advisory | |
https://zerodayinitiative.com/advisories/ZDI-17-950 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Netgain-systems Search vendor "Netgain-systems" | Enterprise Manager Search vendor "Netgain-systems" for product "Enterprise Manager" | < 7.2.766 Search vendor "Netgain-systems" for product "Enterprise Manager" and version " < 7.2.766" | - |
Affected
|