The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69, as demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file.
References
| Link | Resource |
|---|---|
| http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt | Exploit Third Party Advisory |
| https://community.spiceworks.com/support/inventory/docs/network-config#security | Vendor Advisory |
| https://www.exploit-db.com/exploits/41825/ | Exploit Third Party Advisory VDB Entry |
| http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt | Exploit Third Party Advisory |
| https://community.spiceworks.com/support/inventory/docs/network-config#security | Vendor Advisory |
| https://www.exploit-db.com/exploits/41825/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 03:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-ACCESS-CONTROL-FILE-OVERWRITE.txt - Exploit, Third Party Advisory | |
| References | () https://community.spiceworks.com/support/inventory/docs/network-config#security - Vendor Advisory | |
| References | () https://www.exploit-db.com/exploits/41825/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2017-04-06 15:59
Updated : 2024-11-21 03:31
NVD link : CVE-2017-7237
Mitre link : CVE-2017-7237
CVE.ORG link : CVE-2017-7237
JSON object : View
Products Affected
spiceworks
- spiceworks
CWE