PT-2017-17315 · Cisco · Cisco Policy Suite

Publicado 2017-08-17 · Atualizado 2019-10-03 · CVE-2017-6781

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cisco Policy Suite (CPS) Software for CPS appliances versions 9.0.0 through 12.0.0

Description A vulnerability in the management of shell user accounts could allow an authenticated, local attacker to gain elevated privileges on an affected system. The issue is due to incorrect role-based access control (RBAC) for shell user accounts. An attacker could exploit this by authenticating to an affected appliance and providing crafted user input via the Command Line Interface (CLI). A successful exploit could allow the attacker to acquire a higher privilege level than should have been granted.

Recommendations For versions 9.0.0 through 12.0.0, update to a version that includes the fix for Cisco Bug ID CSCve37724 to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-6781

Produtos afetados

Cisco Policy Suite

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6781 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6781 · Aviso do Fabricante
• http://securityfocus.com/bid/100365 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-cps · Aviso do Fabricante