cbcvebase.
CVE-2014-9619
published 2017-09-19

CVE-2014-9619: Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2…

PriorityP356high7.2CVSS 3.0
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
7.35%
93.6th percentile
Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif.

Affected

12 ranges
VendorProductVersion rangeFixed in
netsweepernetsweeper<= 3.1.9—
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——
netsweepernetsweeper——

CVSS provenance

nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.