CVE-2017-96441 exploit
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior;…
Published 9 y ago · modified 4 mo ago · JSON
Summary
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An unquoted search path vulnerability may allow a non-privileged local attacker to change files in the installation directory and execute arbitrary code with elevated privileges.
Exploit prediction (EPSS)
1.41% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.
Exploits and detections
- EDB-42542 Automated Logic WebCTRL 6.5 - Local Privilege Escalation · local · 2017-08-22
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.0 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- n/a Automated Logic Corporation WebCTRL, i-VU, SiteScan
Classification
- Weakness
- CWE-428 Unquoted Search Path or Element
References
- securityfocus.com /bid/100454 · vdb-entry, x_refsource_BID, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-17-234-01 · x_refsource_MISC, x_transferred
- exploit-db.com /exploits/42542/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2017-9644
- NVD: CVE-2017-9644
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.