CVEvulnerability

CVE-2014-9619

7.2 HIGH Published 2017-09-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-09-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.2 HIGH — CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-434

Description

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif.

Affected configurations

• netsweeper netsweeper (<= 3.1.9) • netsweeper netsweeper 4.0.0 • netsweeper netsweeper 4.0.1 • netsweeper netsweeper 4.0.2 • netsweeper netsweeper 4.0.3 • netsweeper netsweeper 4.0.4 • netsweeper netsweeper 4.0.5 • netsweeper netsweeper 4.0.6 • netsweeper netsweeper 4.0.7 • netsweeper netsweeper 4.0.8 • netsweeper netsweeper 4.1.0 • netsweeper netsweeper 4.1.1

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References