Vulnerability Details : CVE-2017-6554
pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to write to arbitrary files and consequently execute arbitrary code with root privileges via an ACT_NEWFILESENT action.
Vulnerability category: Input validationExecute code
Exploit prediction scoring system (EPSS) score for CVE-2017-6554
Probability of exploitation activity in the next 30 days: 8.24%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 94 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-6554
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST |
7.2
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
1.2
|
5.9
|
NIST |
CWE ids for CVE-2017-6554
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-6554
-
https://0xdeadface.wordpress.com/2017/04/07/multiple-vulnerabilities-in-quest-privilege-manager-6-0-0-xx-cve-2017-6553-cve-2017-6554/
Multiple Vulnerabilities in Quest Privilege Manager 6.0.0.xx (CVE-2017-6553, CVE-2017-6554) | 0xDEADFACE
-
http://packetstormsecurity.com/files/142095/Quest-Privilege-Manager-6.0.0-Arbitrary-File-Write.html
Quest Privilege Manager 6.0.0 Arbitrary File Write ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/41861/
Quest Privilege Manager 6.0.0 - Arbitrary File WriteExploit;Third Party Advisory;VDB Entry
-
https://support.oneidentity.com/privilege-manager-for-unix/kb/SOL133824
Privilege Manager for Unix Hotfix 6.0.0.061 (133824)
-
http://www.securityfocus.com/bid/97686
Quest Privilege Manager CVE-2017-6554 Arbitrary File Overwrite VulnerabilityThird Party Advisory;VDB Entry
Products affected by CVE-2017-6554
- cpe:2.3:a:quest:privilege_manager:6.0.0-27:*:*:*:*:*:*:*
- cpe:2.3:a:quest:privilege_manager:6.0.0-50:*:*:*:*:*:*:*