CVE-2017-14705

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter…

published September 22, 2017

CVSS
—
EPSS
7%
Percentile
94.4
In the wild
Unconfirmed
What it is

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by exploiting CVE-2017-14706. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07360 · 94.4th percentile
Published
2017-09-22T18:00Z
EPSS history
Timeline
  • 22 SEP 18:00Z
    DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter…
    cvelistv5