Vulnerability Details : CVE-2014-3791
Public exploit exists!
Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp.
Vulnerability category: OverflowExecute code
Threat overview for CVE-2014-3791
Top countries where our scanners detected CVE-2014-3791
Top open port discovered on systems with this issue
84
IPs affected by CVE-2014-3791 4
Find out if you* are
affected by CVE-2014-3791!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-3791
Probability of exploitation activity in the next 30 days: 91.44%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2014-3791
-
Easy File Management Web Server Stack Buffer Overflow
Disclosure Date: 2014-05-20First seen: 2020-04-26exploit/windows/http/efs_fmws_userid_bofEasy File Management Web Server v4.0 and v5.3 contains a stack buffer overflow condition that is triggered as user-supplied input is not properly validated when handling the UserID cookie. This may allow a remote attacker to execute arbitrary code. Authors:
CVSS scores for CVE-2014-3791
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2014-3791
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3791
-
http://blog.techorganic.com/2014/05/14/from-fuzzing-to-0-day
From fuzzing to 0-day – Techorganic – Musings from the brainpanExploit
-
http://www.securityfocus.com/bid/67406
Easy File Sharing Web Server Stack Buffer Overflow Vulnerability
-
http://www.exploit-db.com/exploits/33352
Easy File Sharing Web Server 6.8 - Remote Stack Buffer Overflow - Windows remote ExploitExploit
-
http://packetstormsecurity.com/files/126614/Easy-File-Sharing-Web-Server-6.8-Buffer-Overflow.html
Easy File Sharing Web Server 6.8 Buffer Overflow ≈ Packet StormExploit
Products affected by CVE-2014-3791
- cpe:2.3:a:efssoft:easy_file_sharing_web_server:6.8:*:*:*:*:*:*:*