CVE-2017-14706 - CVE House
Back to Database
Status published Critical CVE-2017-14706

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain...

Vulnerability Description

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-14706

Credits & Attribution

No credits recorded in the NVD database.

References

More from denyall

View All →
CVE-2017-14705
DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via...
High 8.1

Affected Vendor

Affected Software

i-suite, web application firewall
Vulnerable Versions:
5.5.0, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.6.0, 5.7.0, 6.0.0, 6.1.0, 6.2.0, 6.3.0, 6.4.0

Timeline

Official Publish: September 22nd, 2017
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.