PT-2017-13831 · Docuware+1 · Docuware Fulltext Search Server+1

Publicado 2017-11-21 · Atualizado 2019-10-03 · CVE-2017-15044

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DocuWare Fulltext Search server versions through 6.11

Description The default installation of the server allows remote users to connect to and download searchable text from the embedded Solr service, bypassing access control features. An attacker can also gain privileges by modifying text. This is due to the server listening on the network interface instead of the localhost interface.

Recommendations For versions through 6.11, reconfigure the server to listen on the localhost interface instead of the network interface to prevent unauthorized access. Additionally, consider restricting access to the Solr service to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2017-15044

Produtos afetados

Docuware Fulltext Search Server

Solr

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-15044 · Nota de Segurança
• http://securityfocus.com/archive/1/541548 · Nota
• https://osv.dev/vulnerability/CVE-2017-15044 · Aviso do Fabricante