CVE-2017-9812

Published: Jul 17, 2017Updated: May 13, 2026 Sources: CVE List NVD BDUCWE-200

7.5HIGH

NVD MITRE

Description

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges.

In plain language

AI Worth attention

This bug in Kaspersky Anti-Virus for Linux File Server lets an attacker use the web interface to read any file on the server without a login, so you should treat it as an active security risk if you expose the web interface to the internet.

Executive summary

Unauthenticated network abuse of the Kaspersky Anti-Virus for Linux File Server web interface allows attackers to manipulate the reportId parameter in the getReportStatus action method to read arbitrary files with limited server privileges.

If affected, business impact

Confidential files exposedCredentials or sensitive data theftService disruption riskRegulatory exposure

What to do now

Check whether your Kaspersky Anti-Virus for Linux File Server version is before “Maintenance Pack 2 Critical Fix 4 (8.0.4.312)”.
Check whether the product’s web interface is reachable from outside your network (for example, accessible from the internet or from untrusted networks).
If it is reachable or you’re unsure, immediately restrict access to the web interface to only trusted IPs or internal networks.
Upgrade/apply the fix to Maintenance Pack 2 Critical Fix 4 (8.0.4.312) or later, following your vendor’s upgrade guidance.
After upgrading, monitor for unusual web requests to the getReportStatus area and review logs for abnormal attempts to access report/status endpoints.

Some work to apply

What is it

Imagine a guard at your office who should only hand out the “status reports,” but a missing check lets someone ask for any document instead. With this bug, someone can reach the antivirus server’s web page and trick it into revealing files from the server, even without logging in. The danger is that the exposed files can include sensitive information stored on that machine.

Who is affected

This matters if you run Kaspersky Anti-Virus for Linux File Server and it has its web interface accessible on a network (especially if it’s reachable from the internet). The vulnerability does not require authentication and can be triggered remotely, so it’s relevant even if you don’t share accounts or user credentials. The risk is highest when the web interface is reachable from untrusted networks, including the public internet.

How urgent is it

This should be treated as urgent because the issue allows remote attackers to read arbitrary files with limited privileges and it is publicly exploit-able. The findings also indicate public exploit code exists, and the exposure is reachable in the default configuration, which increases the chance of real-world attempts. Given the AMBER verdict, prioritize checking exposure and applying the fixed version without delay.

What to do — in detail

Confirm whether you’re exposed

Identify your installed version of Kaspersky Anti-Virus for Linux File Server.
- You’re exposed if your version is before Maintenance Pack 2 Critical Fix 4 (8.0.4.312).
Verify network exposure of the web interface.
- Determine whether the product’s web UI is reachable from:
  - the internet, or
  - any untrusted networks.
- Also confirm firewall rules allow inbound access to the web UI ports from outside trusted IP ranges.

Remediate

Upgrade to the fixed version.
- Apply Maintenance Pack 2 Critical Fix 4 (8.0.4.312) or later per your vendor’s upgrade path.
- After upgrading, re-check the version to ensure the fix is actually installed.
If you can’t upgrade immediately (workaround)
- Restrict access to the web interface so only trusted internal IPs can reach it (or shut down external access entirely).
- Ensure inbound firewall rules do not allow web UI access from the internet.

After patching

Look for suspicious activity
- Review server/web access logs for unusual requests targeting the report/status functionality (notably patterns consistent with getReportStatus).
- Pay attention to repeated requests and requests with unusual reportId-like values.

Timeline

Follow up promptly
- No KEV listing was provided, so a strict KEV-only deadline isn’t known from these findings. Still, use the AMBER urgency to schedule upgrade immediately and complete exposure restriction as soon as possible.

What to monitor going forward

Ongoing attempts to access the web interface from unexpected IPs, especially if the interface should only be internal.
Any error spikes or repeated access to the same endpoint shortly before/after external scanning activity.

Technical context

What’s happening

Weakness type: CWE-200 (information exposure).
Mechanism: The reportId parameter in the web action method getReportStatus can be abused to cause the server to read arbitrary files using the antivirus service’s limited privileges (not full root implied, but still capable of accessing confidential data).

Exposure details from findings

Authentication required: False.
Network attack vector: Remote over the network.
No user interaction required.
Reachable in default config: Yes.
Impact described: Read any file on the server with limited user permissions.

Exploitability status

A public exploit is available (4 known).
KEV: Not listed in CISA KEV (so no KEV-driven deadline is known from the findings).
Exploit likelihood prediction: Provided as an EPSS prediction with a falling trend, but this is not used to justify urgency over confirmed exploit availability.

Practical risk for owners

If your web interface is reachable from untrusted networks, attackers can potentially retrieve sensitive files directly by crafting requests to the affected endpoint/parameter.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.