PT-2017-18805 · Allen · Allen Disk

Ghost · Publicado 2017-05-28 · Atualizado 2020-03-02 · CVE-2017-9249

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Allen Disk version 1.6

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file. The attack vector is the content of this file, and the filename must be specified in the "readfile.php" to exploit this issue.

Recommendations For Allen Disk version 1.6, consider restricting access to the file upload feature and the readfile.php endpoint until a fix is available. As a temporary workaround, avoid using the file upload feature to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-9249

Produtos afetados

Allen Disk

Referências · 4

• 🔥 https://github.com/s3131212/allendisk/issues/21 · Exploit
• https://osv.dev/vulnerability/CVE-2017-9249 · Aviso do Fabricante
• http://securityfocus.com/bid/98743 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9249 · Nota de Segurança