CVE-2017-16610

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within upload_save_do.jsp. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code under the context of the current user. Was ZDI-CAN-4751.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-668

Affected software

Vendor	Product	Versions
NetGain Systems	NetGain Systems Enterprise Manager	v7.2.586 build 877

References

https://www.tenable.com/security/research/tra-2018-02Third Party Advisory
https://zerodayinitiative.com/advisories/ZDI-17-952Third Party Advisory, VDB Entry
https://www.tenable.com/security/research/tra-2018-02Third Party Advisory
https://zerodayinitiative.com/advisories/ZDI-17-952Third Party Advisory, VDB Entry

Timeline

Published: Jan 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-166115.5In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape r CVE-2017-166127.5libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., wit CVE-2017-166139.8An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object s CVE-2017-166149.8SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts,CVE-2017-166159.8An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2.CVE-2017-166169.8An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1. A CVE-2017-166189.8An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (CVE-2017-166297.5In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of CVE-2017-166308.8In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Ins CVE-2017-166316.5In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an Insecure Direct Object Referenc CVE-2017-166327.5In SapphireIMS 4097_1, the password in the database is stored in Base64 format.CVE-2017-166334.3In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.