SB2017060201 - SSRF in Allen Disk
Published: June 2, 2017 Updated: June 2, 2017
Security Bulletin ID
SB2017060201
CSH Severity
High
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Server-side request forgery (CVE-ID: CVE-2017-9307)
The vulnerability allows a remote user to perform SSRF attack.The weakness exists due to an error in remotedownload.php. A remote attacker can conduct port scans and access intranet servers.
Successful exploitation of this vulnerability may allow an attacker to perform SSRF attack to retrieve information for further attacks against vulnerable system by performing unauthorized connections to local resources, gain access to sensitive information and compromise vulnerable system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.