CVE-2017-14705

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by exploiting CVE-2017-14706. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-147069.8DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /w CVE-2017-147097.4The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify X CVE-2017-147105.9The Shein Group Ltd. "SHEIN - Fashion Shopping" app -- aka shein fashion-shopping/id878577184 -- for iOS does not verify X.509 certificates CVE-2017-147118.1The Kickbase GmbH "Kickbase Bundesliga Manager" app before 2.2.1 -- aka kickbase-bundesliga-manager/id678241305 -- for iOS is vulnerable to CVE-2017-147125.4In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Phonecall Notes Title parameter.CVE-2017-147135.4In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Description parameter.CVE-2017-147145.4In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter.CVE-2017-147155.4In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter.CVE-2017-147165.4In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Title parameter.CVE-2017-147175.4In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.CVE-2017-147186.1Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.CVE-2017-147197.5Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen