PT-2017-17267 · Cisco+1 · Cisco Elastic Services Controller+1

Published 2017-07-06 · Updated 2019-10-09 · CVE-2017-6713

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controller versions prior to 2.3.1.434 and 2.3.2

Description A vulnerability in the Play Framework of Cisco Elastic Services Controller could allow an unauthenticated, remote attacker to gain full access to the affected system. This is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacker who can extract the static credentials from an existing installation of Cisco ESC could generate an admin session token that allows access to all instances of the ESC web UI.

Recommendations For versions prior to 2.3.1.434, update to release 2.3.1.434 or later. For versions prior to 2.3.2, update to release 2.3.2 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-264

Related Identifiers

CVE-2017-6713

Affected Products

Cisco Elastic Services Controller

Play Framework

References · 4

• https://osv.dev/vulnerability/CVE-2017-6713 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-esc2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6713 · Security Note
• http://securityfocus.com/bid/99437 · Note