PT-2017-2759 · Cisco · Cisco Elastic Services Controller

Publicado 2017-06-13 · Atualizado 2017-06-23 · CVE-2017-6683

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controllers version 2.2(9.76)

Description A vulnerability in the esc listener.py script could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system. The issue arises due to the lack of neutralization of special elements used in the operating system command.

Recommendations For version 2.2(9.76), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2017-02008

CVE-2017-6683

Produtos afetados

Cisco Elastic Services Controller

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6683 · Nota de Segurança
• http://securityfocus.com/bid/98982 · Nota
• https://bdu.fstec.ru/vul/2017-02008 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6683 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esc2 · Aviso do Fabricante