CVE-2017-14705 - CVE House
Back to Database
Status published High CVE-2017-14705

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via...

Vulnerability Description

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by exploiting CVE-2017-14706. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-14705

Credits & Attribution

No credits recorded in the NVD database.

References

More from denyall

View All →
CVE-2017-14706
DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain...
Critical 9.8

Affected Vendor

Affected Software

i-suite, web application firewall
Vulnerable Versions:
5.5.0, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.6.0, 5.7.0, 6.0.0, 6.1.0, 6.2.0, 6.3.0, 6.4.0

Timeline

Official Publish: September 22nd, 2017
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.