CVE-2017-9810 EXPLOIT
8.8
HIGH · CVSS 3.0 · EPSS 1.9% (pctl 79)
Patch early
A public exploit exists.
Description
There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.
Scoring
| CVSS | 8.8 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| EPSS | 1.93% — more likely to be exploited than 79% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2017-07-17 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| kaspersky | anti-virus for linux server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | 2017-06-28 |
References
- http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html
- http://seclists.org/fulldisclosure/2017/Jun/33
- http://www.securityfocus.com/bid/99330
- http://www.securitytracker.com/id/1038798
- https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities
- https://www.exploit-db.com/exploits/42269/
- http://packetstormsecurity.com/files/143190/Kaspersky-Anti-Virus-File-Server-8.0.3.297-XSS-CSRF-Code-Execution.html
- http://seclists.org/fulldisclosure/2017/Jun/33
- http://www.securityfocus.com/bid/99330
- http://www.securitytracker.com/id/1038798
- https://www.coresecurity.com/advisories/kaspersky-anti-virus-file-server-multiple-vulnerabilities
- https://www.exploit-db.com/exploits/42269/
→ the Explorer · watch your stack · NVD