PT-2017-16142 · Cisco · Cisco Workload Automation Client Manager Server+1

Publicado 2017-03-15 · Atualizado 2017-07-12 · CVE-2017-3846

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Workload Automation Client Manager Server versions 6.3.0.116 and later Cisco Tidal Enterprise Scheduler Client Manager Server versions 6.2.1.435 and later

Description The issue is caused by insufficient input validation, allowing an unauthenticated, remote attacker to retrieve any file from the Client Manager Server by sending a crafted URL. This could enable the attacker to access sensitive information.

Recommendations For Cisco Workload Automation Client Manager Server versions 6.3.0.116 and later, update to a version that includes the fix for this issue. For Cisco Tidal Enterprise Scheduler Client Manager Server versions 6.2.1.435 and later, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Client Manager Server to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-3846

Produtos afetados

Cisco Tidal Enterprise Scheduler Client Manager Server

Cisco Workload Automation Client Manager Server

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-3846 · Aviso do Fabricante
• http://securitytracker.com/id/1038044 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3846 · Nota de Segurança
• http://securityfocus.com/bid/96910 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-tes · Aviso do Fabricante