$ cve CVE-2014-6287 JSON

CVE-2014-6287 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 99.3% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.32% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-94
On CISA KEV	yes — remediate by 2022-04-15
Public exploit	yes
Published	2014-10-07
Last modified	2026-06-17

CISA KEV

Name	Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
Added	2022-03-25
Due	2022-04-15
Vendor / product	Rejetto / HTTP File Server (HFS)
Ransomware use	none reported

Affected (1)

Vendor	Product
rejetto	http file server

Public exploits

Source	Title	Date
exploit-db	Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)	2020-11-30
exploit-db	Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)	2016-01-04
exploit-db	Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)	2014-10-09
exploit-db	Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)	2014-09-15

References

→ the Explorer · watch your stack · NVD