All the vulnerabilites related to GFI - Archiver
cve-2024-11948
Vulnerability from cvelistv5
Published
2024-12-11 21:55
Modified
2024-12-11 21:55
Severity ?
EPSS score ?
Summary
GFI Archiver Telerik Web UI Remote Code Execution Vulnerability
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-1671/ | x_research-advisory |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Archiver",
"vendor": "GFI",
"versions": [
{
"status": "affected",
"version": "15.6"
}
]
}
],
"dateAssigned": "2024-11-27T17:38:31.799-06:00",
"datePublic": "2024-12-11T11:27:20.803-06:00",
"descriptions": [
{
"lang": "en",
"value": "GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the product installer. The issue results from the use of a vulnerable version of Telerik Web UI. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-24041."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1395",
"description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-11T21:55:03.698Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1671",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1671/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "GFI Archiver Telerik Web UI Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11948",
"datePublished": "2024-12-11T21:55:03.698Z",
"dateReserved": "2024-11-27T23:38:31.773Z",
"dateUpdated": "2024-12-11T21:55:03.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-11949
Vulnerability from cvelistv5
Published
2024-12-11 21:55
Modified
2024-12-11 21:55
Severity ?
EPSS score ?
Summary
GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-1672/ | x_research-advisory |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Archiver",
"vendor": "GFI",
"versions": [
{
"status": "affected",
"version": "15.6"
}
]
}
],
"dateAssigned": "2024-11-27T17:38:51.072-06:00",
"datePublic": "2024-12-11T11:27:25.515-06:00",
"descriptions": [
{
"lang": "en",
"value": "GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the Store Service, which listens on TCP port 8018 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24331."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-11T21:55:10.645Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1672",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1672/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11949",
"datePublished": "2024-12-11T21:55:10.645Z",
"dateReserved": "2024-11-27T23:38:51.046Z",
"dateUpdated": "2024-12-11T21:55:10.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-11947
Vulnerability from cvelistv5
Published
2024-12-11 21:54
Modified
2024-12-11 21:54
Severity ?
EPSS score ?
Summary
GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-1670/ | x_research-advisory |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Archiver",
"vendor": "GFI",
"versions": [
{
"status": "affected",
"version": "15.6"
}
]
}
],
"dateAssigned": "2024-11-27T17:38:18.268-06:00",
"datePublic": "2024-12-11T11:27:15.585-06:00",
"descriptions": [
{
"lang": "en",
"value": "GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the Core Service, which listens on TCP port 8017 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24029."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-11T21:54:56.061Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1670",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1670/"
}
],
"source": {
"lang": "en",
"value": "Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)"
},
"title": "GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11947",
"datePublished": "2024-12-11T21:54:56.061Z",
"dateReserved": "2024-11-27T23:38:18.186Z",
"dateUpdated": "2024-12-11T21:54:56.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29281
Vulnerability from cvelistv5
Published
2022-07-07 19:38
Modified
2024-08-03 22:02
Severity ?
EPSS score ?
Summary
File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.
References
| ▼ | URL | Tags |
|---|---|---|
| https://cwe.mitre.org/data/definitions/434.html | x_refsource_MISC | |
| https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload | x_refsource_MISC | |
| https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver | x_refsource_MISC | |
| https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/ | x_refsource_MISC | |
| https://www.exploit-db.com/exploits/50181 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:02:51.701Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cwe.mitre.org/data/definitions/434.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/50181"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-07T19:51:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cwe.mitre.org/data/definitions/434.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.exploit-db.com/exploits/50181"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29281",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cwe.mitre.org/data/definitions/434.html",
"refsource": "MISC",
"url": "https://cwe.mitre.org/data/definitions/434.html"
},
{
"name": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload",
"refsource": "MISC",
"url": "https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload"
},
{
"name": "https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver",
"refsource": "MISC",
"url": "https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiver"
},
{
"name": "https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/",
"refsource": "MISC",
"url": "https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/"
},
{
"name": "https://www.exploit-db.com/exploits/50181",
"refsource": "MISC",
"url": "https://www.exploit-db.com/exploits/50181"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29281",
"datePublished": "2022-07-07T19:38:54",
"dateReserved": "2021-03-29T00:00:00",
"dateUpdated": "2024-08-03T22:02:51.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}