PT-2017-17313 · Tail F Systems+1 · Confd Server+1

Publicado 2017-08-17 · Atualizado 2017-08-22 · CVE-2017-6777

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controller (ESC) versions 2.3 through 2.3(2)

Description A vulnerability in the ConfD server could allow an authenticated, remote attacker to acquire sensitive system information due to insufficient protection of sensitive files on the system. An attacker could exploit this by logging into the ConfD server and executing certain commands, potentially allowing an unprivileged user to view configuration parameters that can be maliciously used.

Recommendations For versions 2.3 and 2.3(2), consider restricting access to the ConfD server to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the execution of certain commands on the ConfD server to prevent unauthorized access to sensitive system information.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-6777

Produtos afetados

Cisco Elastic Services Controller

Confd Server

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-6777 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6777 · Nota de Segurança
• http://securityfocus.com/bid/100390 · Nota