nvd-json-data-feeds/CVE-2017/CVE-2017-60xx/CVE-2017-6079.json

{
  "id": "CVE-2017-6079",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2017-05-16T17:29:00.323",
  "lastModified": "2021-09-13T11:20:36.327",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side from the web application: if the command is valid, it executes. An example is the wget command. The page that allows this has been confirmed in firmware as old as 2006."
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n de administraci\u00f3n web HTTP en dispositivos Edgewater Networks Edgemarc, tiene una p\u00e1gina oculta que permite establecer comandos definidos por el usuario, como rutas iptables espec\u00edficas, etc.. Pueden utilizar esta p\u00e1gina como un shell web esencialmente para ejecutar comandos, aunque no consigan retroalimentaci\u00f3n del lado del cliente de la aplicaci\u00f3n web: si el comando es v\u00e1lido, se ejecuta. Un ejemplo es el comando wget. La p\u00e1gina que permite esto se ha confirmado en un firmware tan antiguo como el 2006."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "acInsufInfo": true,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:ribboncommunications:edgemarc_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "82C4112D-48DA-4829-9B4B-E5FF8B9491A7"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4550:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E720E7F6-0BDA-4C02-B69A-854C178C94A1"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4552:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D25CA9B-8D0D-45A2-8D00-03E0F7E40519"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4601:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "13F142C5-A17E-4AB8-BFC3-5AE338E53D13"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4700:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1C35E8B-21D7-4D84-9CE8-6E97FC0B5288"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4750:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5132F55-CC24-4D3B-80B8-B52551AF0DBF"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4800:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "512891B5-D948-48E2-9C0F-1A77C71B8426"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4806:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4FD19254-9B77-453C-80EA-1A259D7BD036"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_4808:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "11ECF931-E24D-4562-8186-1482C3A5A4D6"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_7301:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71932337-DE5A-4773-ACDB-A1A4766B2886"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ribboncommunications:edgemarc_7400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F81DF2A-8C5F-4FE2-82B3-D4809FACC4E6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ]
    }
  ]
}