Critical severity · published Oct 16, 2017
CVE-2017-9367
A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of…
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Workspaces Appliance-x · Blackberry
through 1.11.2 · source: NVD
WV
Workspaces Vapp · Blackberry
5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9367
Vendor Advisory
http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000045696
More from Workspaces Appliance-x
7.5
CVE-2017-9368
An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applications by crafting a…