CVE-2017-17055

Severity: critical (CVSS 9.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-12-07 · updated 2026-06-17
Weakness: CWE-78

Description

Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to freeradius.users.php.

Affected products

Artica Tech Artica Proxy: before 3.06.112911 — fixed in 3.06.112911

How to fix

Upgrade to a fixed version: Artica Tech Artica Proxy 3.06.112911. Check the vendor advisory for mitigations.

References

http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt
http://packetstormsecurity.com/files/145183/Artica-Web-Proxy-3.06.112216-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2017/Dec/3
https://www.exploit-db.com/exploits/43206/
http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt
http://packetstormsecurity.com/files/145183/Artica-Web-Proxy-3.06.112216-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2017/Dec/3
https://www.exploit-db.com/exploits/43206/

Get alerted when CVE-2017-17055 or the next vulnerability affects your stack