CVE-2014-9619
HighSummary
CVE-2014-9619 describes an unrestricted file upload vulnerability in Netsweeper that allows remote authenticated users with admin privileges to execute arbitrary PHP code by uploading a file with a double extension.
Risk Assessment
Organizations may be exposed to remote code execution, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to update Netsweeper to versions 3.1.10, 4.0.9, or 4.1.2 to mitigate this vulnerability and implement additional file upload security measures.
Other vulnerabilities in Netsweeper
See all- CVE-2014-9616High
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive information by making a request that redirects to the deny page.
- CVE-2014-9605High
WebUpgrade in Netsweeper before version 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters.
- CVE-2014-9611Critical
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php.
Original NVD description (English source)
Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to execute arbitrary PHP code by uploading a file with a double extension, then accessing it via a direct request to the file in webadmin/deny/images/, as demonstrated by secuid0.php.gif.