CVEvulnerability

CVE-2017-14705

8.1 HIGH Published 2017-09-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-09-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-78

Description

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by exploiting CVE-2017-14706. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.

Affected configurations

• denyall i-suite 5.5.0 • denyall i-suite 5.5.9 • denyall i-suite 5.5.10 • denyall i-suite 5.5.11 • denyall i-suite 5.5.12 • denyall i-suite 5.6.0 • denyall web application firewall 5.7.0 • denyall web application firewall 6.0.0 • denyall web application firewall 6.1.0 • denyall web application firewall 6.2.0 • denyall web application firewall 6.3.0 • denyall web application firewall 6.4.0

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References