PT-2018-8508 · Accellion · Kiteworks

Jer1Nj0Y · Published 2018-05-24 · Updated 2018-06-27 · CVE-2017-9421

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accellion kiteworks versions prior to 2017.01.00

Description The issue allows remote attackers to bypass authentication and execute certain API calls on behalf of a web user. This is achieved by using a gathered token via a POST request to "/oauth/token".

Recommendations For versions prior to 2017.01.00, update to version 2017.01.00 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-9421

Affected Products

Kiteworks

References · 3

• https://osv.dev/vulnerability/CVE-2017-9421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9421 · Security Note
• https://github.com/jer1nj0y/Vulns/blob/master/Kiteworks%20Vulnerability · Note