CVE-2017-14105

Name: CVE-2017-14105
Creator: NVD / NIST
Published: 2017-09-01T17:29:00.213+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.30%

Last modified Jun 17, 2026

CVE-2017-14105 is a vulnerability of currently unknown severity. HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps (it will be exposed at the web interface).. EPSS estimates a 1.30% chance of exploitation in the next 30 days.

Description

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps (it will be exposed at the web interface).

Metrics

EPSS Probability

1.30%

66.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions
Aerohive	Hivemanager Classic	8.0r1
Aerohive	Hivemanager Classic	8.1r1

References

https://github.com/theguly/CVE-2017-14105Exploit, Patch, Third Party Advisory
https://github.com/theguly/CVE-2017-14105Exploit, Patch, Third Party Advisory

Timeline

Published: Sep 1, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-14105?

How severe is CVE-2017-14105?

Severity scoring for CVE-2017-14105 is pending analysis. The EPSS model estimates a 1.30% probability of exploitation in the next 30 days.

How do I fix CVE-2017-14105?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-14105?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST