PT-2017-13447 · Eyesofnetwork · Eyesofnetwork

Publicado 2017-09-13 · Atualizado 2021-02-23 · CVE-2017-14404

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface (aka eonweb) versions 5.1-0

Description The issue allows for local file inclusion via the tool list parameter (also referred to as the url tool variable) to the "module/tool all/select tool.php" endpoint. This can be exploited, for example, by using a tool list value such as php://filter/.

Recommendations For EyesOfNetwork web interface (aka eonweb) versions 5.1-0, consider restricting access to the module/tool all/select tool.php endpoint to minimize the risk of exploitation. Avoid using the tool list parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-14404

Produtos afetados

Eyesofnetwork

Referências · 4

• 🔥 http://sstrunk.com/cve/eonweb_module_tool_all_select_tool.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14404 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14404 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14404 · Aviso do Fabricante