8.8high
CVE-2017-68031 exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyage…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.4%
percentile 91%
Public exploits
1
Exploit-DB
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that (1) change the admin password, (2) terminate the scheduler, or (3) possibly execute arbitrary commands via crafted requests to Admin/XML/Result.xml.
Exploit prediction (EPSS)
4.35% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
Exploits and detections
- EDB-41574 FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery · webapps · 2017-03-10
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-352 Cross-Site Request Forgery
References
- packetstormsecurity.com /files/141567/FTP-Voyager-Scheduler-16.2.0-CSRF-Denial-Of-Service.html · x_refsource_MISC, x_transferred
- securityfocus.com /bid/96814 · vdb-entry, x_refsource_BID, x_transferred
- hyp3rlinx.altervista.org /advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt · x_refsource_MISC, x_transferred
- exploit-db.com /exploits/41574/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2017-6803
- NVD: CVE-2017-6803
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.