Vulnerability Description
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful exploitation of the software will allow an attacker to gain complete access to the system with NT AUTHORITY / SYSTEM level privileges. The vulnerability lies due to improper handling and sanitization of the incoming request.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flexense | Dupscout | 9.9.14 |
| Flexense | Disksavvy | 9.9.14 |
| Flexense | Syncbreeze | 9.9.16 |
| Flexense | Diskpulse | 9.9.16 |
Related Weaknesses (CWE)
References
- https://www.exploit-db.com/exploits/42557ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42558/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42559/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42560/ExploitThird Party AdvisoryVDB Entry
- https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_getThird Party Advisory
- https://www.exploit-db.com/exploits/42557ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42558/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42559/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/42560/ExploitThird Party AdvisoryVDB Entry
- https://www.rapid7.com/db/modules/exploit/windows/http/disk_pulse_enterprise_getThird Party Advisory
FAQ
What is CVE-2017-13696?
CVE-2017-13696 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an ...
How severe is CVE-2017-13696?
CVE-2017-13696 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-13696?
Check the references section above for vendor advisories and patch information. Affected products include: Flexense Dupscout, Flexense Disksavvy, Flexense Syncbreeze, Flexense Diskpulse.