CVE-2017-14123

Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2017-09-04

Last modified

2024-08-05

Weaknesses

CWE-434

Affected products

• Manageengine Firewall Analyzer (Zohocorp)

References

• https://blogs.securiteam.com/index.php/archives/3228
• https://pitstop.manageengine.com/portal/kb/articles/latest-consolidated-patch