PT-2017-18805 · Allen · Allen Disk

Ghost · Published 2017-05-28 · Updated 2020-03-02 · CVE-2017-9249

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Allen Disk version 1.6

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file. The attack vector is the content of this file, and the filename must be specified in the "readfile.php" to exploit this issue.

Recommendations For Allen Disk version 1.6, consider restricting access to the file upload feature and the readfile.php endpoint until a fix is available. As a temporary workaround, avoid using the file upload feature to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9249

Affected Products

Allen Disk

References · 4

• 🔥 https://github.com/s3131212/allendisk/issues/21 · Exploit
• https://osv.dev/vulnerability/CVE-2017-9249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9249 · Security Note
• http://securityfocus.com/bid/98743 · Note