CVE-2017-9367

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-93687.5An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for seCVE-2017-93693.8In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the defaulCVE-2017-93708.8An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker whoCVE-2017-93712.6In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default confCVE-2017-93727.5PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other prCVE-2017-93735.5Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a deniCVE-2017-93745.5Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a deniCVE-2017-93755.5QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial ofCVE-2017-93766.5ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do anCVE-2017-93778.8A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0CVE-2017-93786.5BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was CVE-2017-93798.8Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.p
CVE-2017-9367: Critical severity, CVSS 9.8 | Vulnix