Vulnerability-Lookup

CNVD-2018-10477

Vulnerability from cnvd - Published: 2018-05-29

Title

GridGain目录遍历漏洞

Description

GridGain是GridGain Systems公司的一套内存计算平台。Visor GUI Console是其中的一个可视化控制台。 GridGain中的Visor GUI Console存在目录遍历漏洞。远程攻击者可借助特制的路径利用该漏洞读取任意文件。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： www.openwall.com/lists/oss-security/2017/10/05/1

Reference

https://nvd.nist.gov/vuln/detail/CVE-2017-14614

Impacted products

Name
['GridGain GridGain <1.7.16', 'GridGain GridGain 1.8.，<1.8.12', 'GridGain GridGain 1.9.，<1.9.7', 'GridGain GridGain 8.*，<8.1.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-14614",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14614"
    }
  },
  "description": "GridGain\u662fGridGain Systems\u516c\u53f8\u7684\u4e00\u5957\u5185\u5b58\u8ba1\u7b97\u5e73\u53f0\u3002Visor GUI Console\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u53ef\u89c6\u5316\u63a7\u5236\u53f0\u3002\r\n\r\nGridGain\u4e2d\u7684Visor GUI Console\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u8def\u5f84\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6\u3002",
  "discovererName": "Unknow",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nwww.openwall.com/lists/oss-security/2017/10/05/1",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-10477",
  "openTime": "2018-05-29",
  "products": {
    "product": [
      "GridGain GridGain \u003c1.7.16",
      "GridGain GridGain 1.8.*\uff0c\u003c1.8.12",
      "GridGain GridGain 1.9.*\uff0c\u003c1.9.7",
      "GridGain GridGain 8.*\uff0c\u003c8.1.5"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-14614",
  "serverity": "\u4e2d",
  "submitTime": "2018-05-24",
  "title": "GridGain\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2017-14614 (GCVE-0-2017-14614)

Vulnerability from cvelistv5 – Published: 2017-10-09 14:00 – Updated: 2024-08-05 19:34

Summary

Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
http://www.openwall.com/lists/oss-security/2017/10/05/1	mailing-listx_refsource_MLIST

Date Public

2017-10-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:34:39.410Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20171005 [CVE-2017-14614] GridGain Visor GUI Console - File System Path Traversal",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/10/05/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-10-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-09T13:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20171005 [CVE-2017-14614] GridGain Visor GUI Console - File System Path Traversal",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/10/05/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14614",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20171005 [CVE-2017-14614] GridGain Visor GUI Console - File System Path Traversal",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/10/05/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14614",
    "datePublished": "2017-10-09T14:00:00.000Z",
    "dateReserved": "2017-09-20T00:00:00.000Z",
    "dateUpdated": "2024-08-05T19:34:39.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-10477

CVE-2017-14614 (GCVE-0-2017-14614)

Tags

Sightings

Nomenclature