Vulnerability Details : CVE-2017-14980
Public exploit exists!
Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login.
Vulnerability category: Overflow
Exploit prediction scoring system (EPSS) score for CVE-2017-14980
Probability of exploitation activity in the next 30 days: 8.99%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 94 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2017-14980
-
Sync Breeze Enterprise GET Buffer Overflow
Disclosure Date: 2017-03-15First seen: 2020-04-26exploit/windows/http/syncbreeze_bofThis module exploits a stack-based buffer overflow vulnerability in the web interface of Sync Breeze Enterprise v9.4.28, v10.0.28, and v10.1.16, caused by improper bounds checking of the request in HTTP GET and POST requests sent to the built-in web server. This
CVSS scores for CVE-2017-14980
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2017-14980
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-14980
-
http://packetstormsecurity.com/files/144452/Sync-Breeze-Enterprise-10.0.28-Buffer-Overflow.html
Sync Breeze Enterprise 10.0.28 Buffer Overflow ≈ Packet StormExploit;Third Party Advisory;VDB Entry
Products affected by CVE-2017-14980
- cpe:2.3:a:flexense:syncbreeze:10.0.28:*:*:*:enterprise:*:*:*