CVE-2014-6287: rejetto http file server

csirt@kutim:~/threat-intel/cve/CVE-2014-6287

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,3%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada rejetto http file server. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Rincian

Terbit di NVD: 7 Oktober 2014
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 99,3% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
Masuk KEV: 25 Maret 2022
Tenggat CISA: 15 April 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
rejetto	http file server	Versi 2.3 hingga sebelum 2.3c

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.kb.cert.org/vuls/id/251276 advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6287 pemerintah AS
http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry
http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
https://www.exploit-db.com/exploits/39161/ exploit · advisory pihak ketiga · vdb entry
https://github.com/rapid7/metasploit-framework/pull/3793 exploit

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.