PT-2017-17314 · Cisco · Services Controller+1

Publicado 2017-08-17 · Atualizado 2017-08-25 · CVE-2017-6778

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Ultra Services Platform version 21.0.v0.65839

Description A vulnerability in the Elastic Services Controller (ESC) web interface could allow an authenticated, remote attacker to acquire sensitive information. This is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this by sending a GET request to a vulnerable device, potentially allowing them to view information regarding the Ultra Services Platform deployment.

Recommendations For version 21.0.v0.65839, consider restricting access to the ESC web interface until a fix is available. As a temporary workaround, avoid using the GET request method to sensitive information endpoints.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-6778

Produtos afetados

Cisco Ultra Services Platform

Services Controller

Referências · 4

• http://securityfocus.com/bid/100380 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-usp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6778 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6778 · Aviso do Fabricante