CVE-2017-14123

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-09-04T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the \"Group Chat\" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-04T19:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch"}, {"tags": ["x_refsource_MISC"], "url": "https://blogs.securiteam.com/index.php/archives/3228"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-14123", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the \"Group Chat\" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch", "refsource": "MISC", "url": "https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch"}, {"name": "https://blogs.securiteam.com/index.php/archives/3228", "refsource": "MISC", "url": "https://blogs.securiteam.com/index.php/archives/3228"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:20:40.278Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blogs.securiteam.com/index.php/archives/3228"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-14123", "datePublished": "2017-09-04T20:00:00.000Z", "dateReserved": "2017-09-04T00:00:00.000Z", "dateUpdated": "2024-08-05T19:20:40.278Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:12.2:12200:*:*:*:*:*:*", "matchCriteriaId": "05955BD9-919D-4088-BD16-0C3BB81F354B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the \"Group Chat\" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp."}, {"lang": "es", "value": "Zoho ManageEngine Firewall Analyzer 12200 tiene una vulnerabilidad de subida de archivos sin restricci\u00f3n en la secci\u00f3n \"Group Chat\". Cualquier usuario podr\u00eda subir archivos con cualquier extensi\u00f3n. Al subir un archivo PHP al servidor, un atacante podr\u00eda hacer que se ejecute en el contexto del servidor, tal y como se puede ver en /itplus/FileStorage/302/shell.jsp."}], "id": "CVE-2017-14123", "lastModified": "2026-06-17T01:05:38.540", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-04T20:29:00.197", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://blogs.securiteam.com/index.php/archives/3228"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://blogs.securiteam.com/index.php/archives/3228"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}