CVEvulnerability
CVE-2015-4027
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-12-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability Scanner (WVS) before 10 build 20151125 allows local users to gain privileges via a command parameter in the reporttemplate property in a params JSON object to api/addScan.
Affected configurations
• acunetix web vulnerability scanner (<= 10)
Related
Weakness · not in database (1)
References
- http://packetstormsecurity.com/files/134602/Acunetix-WVS-10-Local-Privilege-Escalation.html Exploit
- https://www.acunetix.com/blog/releases/acunetix-10-build-includes-security-checks-in-cors-configurations/ Vendor Advisory
- https://www.exploit-db.com/exploits/38847/ Exploit
- http://packetstormsecurity.com/files/134602/Acunetix-WVS-10-Local-Privilege-Escalation.html Exploit
- https://www.acunetix.com/blog/releases/acunetix-10-build-includes-security-checks-in-cors-configurations/ Vendor Advisory
- https://www.exploit-db.com/exploits/38847/ Exploit