CVE-2017-18001
Trustwave SWG 11.8.0.27 - SSH Unauthorized Access
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.
Trustwave Secure Web Gateway (SWG) hasta la versión 11.8.0.27 permite que los atacantes remotos anexen una clave pública arbitraria a los datos de claves SSH autorizadas del dispositivo y obtener acceso root remoto en consecuencia mediante el parámetro publicKey al URI /sendKey.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-12-31 CVE Reserved
- 2017-12-31 CVE Published
- 2023-05-24 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (4)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://www.exploit-db.com/exploits/44047 | 2024-08-05 | |
http://seclists.org/fulldisclosure/2017/Dec/88 | 2024-08-05 | |
https://blogs.securiteam.com/index.php/archives/3550 | 2024-08-05 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Trustwave Search vendor "Trustwave" | Secure Web Gateway Search vendor "Trustwave" for product "Secure Web Gateway" | <= 11.8.0.27 Search vendor "Trustwave" for product "Secure Web Gateway" and version " <= 11.8.0.27" | - |
Affected
|