| |
Vulnerability CVE-2017-14105
Published: 2017-09-01
Description: |
HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps (it will be exposed at the web interface). |
See advisories in our WLB2 database: | Topic | Author | Date |
High |
| Sandro Zaccarini | 10.09.2017 |
Type:
CWE-264 (Permissions, Privileges, and Access Controls)
CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Base Score |
Impact Subscore |
Exploitability Subscore |
7.2/10 |
10/10 |
3.9/10 |
Exploit range |
Attack complexity |
Authentication |
Local |
Low |
No required |
Confidentiality impact |
Integrity impact |
Availability impact |
Complete |
Complete |
Complete |
References: |
https://github.com/theguly/CVE-2017-14105
|
|
|
closedb();
?>
Copyright 2024, cxsecurity.com
|
|
|