Vulnerability Details : CVE-2014-3791
Public exploit exists!
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp.
Vulnerability category: OverflowExecute code
Products affected by CVE-2014-3791
- cpe:2.3:a:efssoft:easy_file_sharing_web_server:6.8:*:*:*:*:*:*:*
Threat overview for CVE-2014-3791
Top countries where our scanners detected CVE-2014-3791
Top open port discovered on systems with this issue
84
IPs affected by CVE-2014-3791 4
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2014-3791!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-3791
81.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2014-3791
-
Easy File Management Web Server Stack Buffer Overflow
Disclosure Date: 2014-05-20First seen: 2020-04-26exploit/windows/http/efs_fmws_userid_bofEasy File Management Web Server v4.0 and v5.3 contains a stack buffer overflow condition that is triggered as user-supplied input is not properly validated when handling the UserID cookie. This may allow a remote attacker to execute arbitrary code. Authors:
CVSS scores for CVE-2014-3791
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2014-3791
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3791
-
http://osvdb.org/show/osvdb/106965
-
http://blog.techorganic.com/2014/05/14/from-fuzzing-to-0-day
From fuzzing to 0-day – Techorganic – Musings from the brainpanExploit
-
http://www.securityfocus.com/bid/67406
Easy File Sharing Web Server Stack Buffer Overflow Vulnerability
-
http://www.exploit-db.com/exploits/33352
Easy File Sharing Web Server 6.8 - Remote Stack Buffer Overflow - Windows remote ExploitExploit
-
http://packetstormsecurity.com/files/126614/Easy-File-Sharing-Web-Server-6.8-Buffer-Overflow.html
Easy File Sharing Web Server 6.8 Buffer Overflow ≈ Packet StormExploit
Jump to