CVE-2017-17055

Опубликовано: 07 дек. 2017

Источник: nvd

CVSS3: 9

CVSS2: 8.5

EPSS Низкий

Описание

Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to freeradius.users.php.

Ссылки

http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt
Exploit
Vendor Advisory
http://packetstormsecurity.com/files/145183/Artica-Web-Proxy-3.06.112216-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2017/Dec/3
Exploit
Mailing List
Third Party Advisory
https://www.exploit-db.com/exploits/43206/
Exploit
Third Party Advisory
VDB Entry
http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt
Exploit
Vendor Advisory
http://packetstormsecurity.com/files/145183/Artica-Web-Proxy-3.06.112216-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2017/Dec/3
Exploit
Mailing List
Third Party Advisory
https://www.exploit-db.com/exploits/43206/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:*

Версия до 3.06.112911 (исключая)

EPSS

Процентиль: 89%

0.04573

Низкий

9 Critical

CVSS3

8.5 High

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-296m-rvp8-vc89