CVE-2017-14614
Last modified
CVE-2017-14614 is a vulnerability of currently unknown severity. Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path.. EPSS estimates a 1.57% chance of exploitation in the next 30 days.
Description
Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Gridgain | Gridgain | 8.0.0 | Ea1 |
| Gridgain | Gridgain | 8.0.1 | — |
| Gridgain | Gridgain | 8.0.2 | Ea1 |
| Gridgain | Gridgain | 8.0.3 | Ea1 |
| Gridgain | Gridgain | 8.0.4 | Ea1 |
| Gridgain | Gridgain | 8.1.1 | — |
| Gridgain | Gridgain | 8.1.2 | — |
| Gridgain | Gridgain | 8.1.3 | — |
| Gridgain | Gridgain | 8.1.4 | — |
| Gridgain | Gridgain | 1.9.1 | — |
| Gridgain | Gridgain | 1.9.2 | — |
| Gridgain | Gridgain | 1.9.3 | — |
| Gridgain | Gridgain | 1.9.4 | — |
| Gridgain | Gridgain | 1.9.5 | — |
| Gridgain | Gridgain | 1.9.6 | — |
| Gridgain | Gridgain | 1.8.1 | — |
| Gridgain | Gridgain | 1.8.2 | — |
| Gridgain | Gridgain | 1.8.3 | — |
| Gridgain | Gridgain | 1.8.4 | — |
| Gridgain | Gridgain | 1.8.5 | — |
| Gridgain | Gridgain | 1.8.6 | — |
| Gridgain | Gridgain | 1.8.7 | — |
| Gridgain | Gridgain | 1.8.8 | — |
| Gridgain | Gridgain | 1.8.9 | — |
| Gridgain | Gridgain | 1.8.10 | — |
| Gridgain | Gridgain | 1.8.11 | — |
| Gridgain | Gridgain | <= 1.7.15 | — |
References
- http://www.openwall.com/lists/oss-security/2017/10/05/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/10/05/1Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14614?
How severe is CVE-2017-14614?
How do I fix CVE-2017-14614?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14608In LibRaw through 0.18.4, an out of bounds read flaw related…
- CVE-2017-14609The server daemons in Kannel 1.5.0 and earlier create a PID …
- CVE-2017-1461IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vul…
- CVE-2017-14610bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareo…
- CVE-2017-14611SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows …
- CVE-2017-14612"Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka sh…
- CVE-2017-14615An FBX-5313 issue was discovered in WatchGuard Fireware befo…
- CVE-2017-14616An FBX-5312 issue was discovered in WatchGuard Fireware befo…
- CVE-2017-14617In Poppler 0.59.0, a floating point exception occurs in the …
- CVE-2017-14618Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php …
- CVE-2017-14619Cross-site scripting (XSS) vulnerability in phpMyFAQ through…
- CVE-2017-1462IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scri…
Are you affected by CVE-2017-14614?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST