ManageEngine Firewall Analyzer CVE-2017-14123 Arbitrary File Upload Vulnerability

Bugtraq ID:	100837
Class:	Input Validation Error
CVE:	CVE-2017-14123
Remote:	Yes
Local:	No
Published:	Sep 04 2017 12:00AM
Updated:	Sep 04 2017 12:00AM
Credit:	Yasser Ali
Vulnerable:	Zohocorp ManageEngine Firewall Analyzer 12200
Not Vulnerable:

ManageEngine Firewall Analyzer CVE-2017-14123 Arbitrary File Upload Vulnerability

ManageEngine Firewall Analyzer is prone to an arbitrary file-upload vulnerability.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application or privilege escalation.

ManageEngine Firewall Analyzer 12200 is vulnerable; other versions may also be affected.

ManageEngine Firewall Analyzer CVE-2017-14123 Arbitrary File Upload Vulnerability

The researcher has created an exploit code to demonstrate the issue. Please see the references for more information.

ManageEngine Firewall Analyzer CVE-2017-14123 Arbitrary File Upload Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ManageEngine Firewall Analyzer CVE-2017-14123 Arbitrary File Upload Vulnerability

References:

• SSD Advisory �?? ManageEngine Code Execution (securiteam.com)
  
• Latest Consolidated Patch (manageengine.com)
  
• ManageEngine Homepage (ManageEngine)