CVE-2017-14105

ALTO 7.8CVE-2017-14105 · Published 01/09/2017 · updated 17/06/2026

In breve

CVE-2017-14105 è una vulnerabilità ALTO (CVSS 7.8) che riguarda hivemanager classic (aerohive).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 70.6% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
hivemanager classic aerohive	`= 8.0r1= 8.1r1`	No fix yet

Description

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps (it will be exposed at the web interface).

References

theguly/CVE-2017-14105 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free