Back to Database
Status published
High
CVE-2017-9812
The reportId parameter of the getReportStatus action method can be...
Vulnerability Description
The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-9812
Credits & Attribution
No credits recorded in the NVD database.
References
- http://seclists.org/fulldisclosure/2017/Jun/33
- http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html
- http://www.securityfocus.com/bid/99330
- http://www.securitytracker.com/id/1038798
- https://www.exploit-db.com/exploits/42269/
- https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities
More from kaspersky
View All →CVE-2017-9813
In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack...
Medium
6.1
CVE-2017-9811
The kluser is able to interact with the kav4fs-control binary...
Critical
9.8
CVE-2017-9810
There are no Anti-CSRF tokens in any forms on the...
High
8.8
CVE-2016-6231
Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509...
Medium
5.9
CVE-2015-8579
Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write,...
Medium
6.4
Affected Vendor
kaspersky
View all reports →Affected Software
anti-virus for linux server
Vulnerable Versions:
0
Timeline
Official Publish:
July 17th, 2017
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.