Skip to content

CVE-2014-9605 WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the....

HighCVSS 9.4 EPSS 3.9% Public exploit
Published
Updated
Exploit status
Public exploit available
Sign in for asset impact Search another CVE

Description

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.

Affected products

ProductAffected versionsFixed in
netsweeper >= 3.1.0, < 3.1.10 3.1.10
netsweeper >= 4.0.0, < 4.0.9 4.0.9
netsweeper >= 4.1.0, < 4.1.2 4.1.2

References