PT-2017-17599 · Spiceworks · Spiceworks Inventory

Hyp3Rlinx + 1 · Publicado 2017-04-06 · Atualizado 2019-10-03 · CVE-2017-7237

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spiceworks Inventory version 7.5

Description The issue allows remote attackers to access the Spiceworks data/configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69. This can be demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file.

Recommendations For Spiceworks Inventory version 7.5, consider restricting access to the TFTP service to minimize the risk of exploitation. As a temporary workaround, restrict access to UDP port 69 until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2017-7237

Produtos afetados

Spiceworks Inventory

Referências · 5

• 🔥 https://exploit-db.com/exploits/41825 · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt · Exploit
• https://osv.dev/vulnerability/CVE-2017-7237 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7237 · Nota de Segurança
• https://community.spiceworks.com/support/inventory/docs/network-config#security · Aviso do Fabricante