CVE-2017-9367

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
BlackBerry	Workspaces Server	BlackBerry Workspaces Server components Appliance-X 1.11.0 to 1.11.2, vApp versions 5.6.0 to 5.6.6, and vApp versions 5.5.9 and earlier

References

http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000045696Vendor Advisory
http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000045696Vendor Advisory

Timeline

Published: Oct 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-93687.5An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for se CVE-2017-93693.8In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the defaul CVE-2017-93708.8An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker who CVE-2017-93712.6In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default conf CVE-2017-93727.5PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other pr CVE-2017-93735.5Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a deni CVE-2017-93745.5Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a deni CVE-2017-93755.5QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of CVE-2017-93766.5ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do an CVE-2017-93778.8A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0 CVE-2017-93786.5BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was CVE-2017-93798.8Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.p