PT-2017-14575 · Ulterius · Ulterius

Rick Osgood · Publicado 2017-11-13 · Atualizado 2017-11-29 · CVE-2017-16806

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ulterius versions prior to 1.9.5.0

Description The issue concerns directory traversal in the HTTP server of Ulterius. It affects the Process function in RemoteTaskServer/WebServer/HttpServer.cs, allowing unauthorized access to files and directories.

Recommendations For versions prior to 1.9.5.0, update to version 1.9.5.0 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-16806

Produtos afetados

Ulterius

Referências · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/ulterius_file_download.rb · Exploit
• 🔥 https://exploit-db.com/exploits/43141 · Exploit
• https://github.com/Ulterius/server/commit/770d1821de43cf1d0a93c79025995bdd812a76ee · Nota
• https://osv.dev/vulnerability/CVE-2017-16806 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16806 · Nota de Segurança