VULNERABILITY INTELLIGENCE
CVE-2017-14706
CVSS score9.8 CRITICAL
EPSS probability28.24%
CISA KEVNot currently listed
Published2017-09-22
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.
Weakness classification
- CWE-287: Improper Authentication
Primary references
- cve@mitre.org — Exploit, Third Party Advisory
- cve@mitre.org — Exploit, Technical Description, Third Party Advisory
- cve@mitre.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory