CVE-2017-16590

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is required to exploit this vulnerability. The specific flaw exists within the MainFilter servlet. The issue results from the lack of proper string matching inside the doFilter method. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of Administrator. Was ZDI-CAN-5099.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-289CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-165916.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagCVE-2017-165926.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagCVE-2017-165936.5This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7CVE-2017-165946.5This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7CVE-2017-165956.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagCVE-2017-165966.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise ManagCVE-2017-165979.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7CVE-2017-165988.8This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems EntCVE-2017-165996.5This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7CVE-2017-166006.5This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 builCVE-2017-166016.5This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.CVE-2017-166028.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.7
CVE-2017-16590: High severity, CVSS 8.8 | Vulnix