{"id":"CVE-2017-14706","aliases":["EUVD-2017-6203","GHSA-xg92-4q2x-2943"],"status":"published","title":"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication...","description":"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.28243,"percentile":0.98129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2017-09-22T18:00:00Z","modified":"2026-06-17T01:06:38Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/denyall_waf_exec","title":"DenyAll Web Application Firewall Remote Code Execution","type":"exploit","platform":"Python","date":"2017-09-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/denyall_waf_exec"}],"products":[{"vendor":"denyall","product":"i-suite"},{"vendor":"denyall","product":"web_application_firewall"}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/8980","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://pentest.blog/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution/","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.denyall.com/blog/advisories/advisory-unauthenticated-remote-code-execution-denyall-web-application-firewall/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14706"},{"url":"https://pentest.blog/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution"},{"url":"https://www.denyall.com/blog/advisories/advisory-unauthenticated-remote-code-execution-denyall-web-application-firewall"},{"url":"https://github.com/advisories/GHSA-xg92-4q2x-2943"}],"sources":{"cve":[{"id":"CVE-2017-14706","description":"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.","status":"published","published":"2017-09-22T18:00:00Z","modified":"2024-09-16T17:14:42.656Z","updated_at":"2026-11-02T14:33:12.267141Z"}],"euvd":[{"id":"EUVD-2017-6203","description":"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.","status":"published","published":"2017-09-22T18:00:00Z","modified":"2024-09-16T17:14:42Z","updated_at":"2026-11-03T00:55:44.31512Z"}],"ghsa":[{"id":"GHSA-xg92-4q2x-2943","title":"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication...","description":"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.","status":"published","published":"2022-05-17T00:35:15Z","modified":"2025-04-20T03:45:47Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:01:52.186588Z"}],"nvd":[{"id":"CVE-2017-14706","description":"DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.","status":"published","published":"2017-09-22T18:29:00.25Z","modified":"2026-06-17T01:06:38.77Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:03:59.716532Z"}]}}