high8.8Public exploit code
CVE-2017-6803
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager 16.2.0 allow remot…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery2017-03-10 · webapps · xml · Verified
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly Serv-U) FTP Voyager 16.2.0 allow remote attackers to hijack the authentication of users for requests that (1) change the admin password, (2) terminate the scheduler, or (3) possibly execute arbitrary commands via crafted requests to Admin/XML/Result.xml.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Solarwinds | Ftp Voyager | Version 16.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt
- http://packetstormsecurity.com/files/141567/FTP-Voyager-Scheduler-16.2.0-CSRF-Denial-Of-Service.html
- http://www.securityfocus.com/bid/96814
- https://www.exploit-db.com/exploits/41574/
- http://hyp3rlinx.altervista.org/advisories/FTP-VOYAGER-SCHEDULER-CSRF-REMOTE-CMD-EXECUTION.txt
- http://packetstormsecurity.com/files/141567/FTP-Voyager-Scheduler-16.2.0-CSRF-Denial-Of-Service.html
- http://www.securityfocus.com/bid/96814
- https://www.exploit-db.com/exploits/41574/