CVE-2017-14706

9.8 CRITICAL
Published: September 22, 2017 Modified: May 13, 2026
View on NVD

Description

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/8980
Source: cve@mitre.org
Exploit Third Party Advisory
https://pentest.blog/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution/
Source: cve@mitre.org
Exploit Technical Description Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/8980
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://pentest.blog/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Technical Description Third Party Advisory

6 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.8 / 10.0
EPSS (Exploit Probability)
28.2%
98th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

Affected Vendors

denyall