PT-2017-17281 · Cisco · Cisco Wide Area Application Services+3

Published 2017-07-10 · Updated 2017-07-16 · CVE-2017-6730

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wide Area Application Services (WAAS) versions 4.4(7) through 6.2(3) Cisco Wide Area Application Services (WAAS) version 6.2(1)

Description A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system. This issue affects Cisco WAAS products configured with the Central Manager role, including Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, and Cisco Wide Area Application Services (WAAS) Modules.

Recommendations For versions 4.4(7) through 6.2(3), update to version 6.3(0.228) or later to resolve the issue. For version 6.2(1), update to version 6.2(3d)8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Central Manager function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-6730

Affected Products

Cisco Virtual Wide Area Application Services

Cisco Wide Area Application Services

Cisco Wide Area Application Services (Waas) Appliances

Cisco Wide Area Application Services (Waas) Modules

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6730 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6730 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas1 · Vendor Advisory
• http://securityfocus.com/bid/99481 · Note
• http://securitytracker.com/id/1038825 · Note