| Vulnerability Details | |
|---|---|
| Impact | CVSS V3 rating: 7.5 (High) |
| Reported | 29 Jun 2018 |
| Fixed | 29 Nov 2018 |
| Affected Builds | Till Build 123147 |
| Fixed in | Build 123231 |
| Overview | Incorrect Access Control in FailOverHelperServlet |
| Recommended Fix | Upgrade to Firewall Analyzer Version 12.3.231 or above. |
Incorrect Access Control in FailOverHelperServlet in Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring.
We recommend that you upgrade to Firewall Analyzer version 12.3.231 and above to fix this issue.
Source and Acknowledgements
Find out more about CVE-2018-12997 from the CVE dictionary.
For clarification or corrections please contact our support team or email us at fwanalyzer-support@manageengine.com