PT-2017-17281 · Cisco · Cisco Wide Area Application Services+3

Publicado 2017-07-10 · Atualizado 2017-07-16 · CVE-2017-6730

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services (WAAS) versions 4.4(7) through 6.2(3) Cisco Wide Area Application Services (WAAS) version 6.2(1)

Description A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system. This issue affects Cisco WAAS products configured with the Central Manager role, including Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, and Cisco Wide Area Application Services (WAAS) Modules.

Recommendations For versions 4.4(7) through 6.2(3), update to version 6.3(0.228) or later to resolve the issue. For version 6.2(1), update to version 6.2(3d)8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Central Manager function until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-6730

Produtos afetados

Cisco Virtual Wide Area Application Services

Cisco Wide Area Application Services

Cisco Wide Area Application Services (Waas) Appliances

Cisco Wide Area Application Services (Waas) Modules

Referências · 5

• http://securityfocus.com/bid/99481 · Nota
• http://securitytracker.com/id/1038825 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6730 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6730 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas1 · Aviso do Fabricante