CVE-2017-14706
Critical
Description
DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.
SeverityCritical
CVSS9.8
Exploit probability—
ProductDenyall I-suite
PublishedSep 22, 2017
First seenSep 22, 2017
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| denyall i-suite | 5.5.0, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.6.0 | — |
| denyall web_application_firewall | 5.7.0, 6.0.0, 6.1.0, 6.2.0, 6.3.0, 6.4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.