PT-2017-17287 · Cisco · Cisco Web Security Appliance

Published 2017-07-25 · Updated 2017-08-08 · CVE-2017-6746

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance (WSA) versions 10.0 through 10.1.0-204 Cisco Web Security Appliance (WSA) version 10.1.0-204

Description A vulnerability in the web interface of the Cisco Web Security Appliance could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid administrator credentials.

Recommendations For Cisco Web Security Appliance (WSA) versions 10.0 through 10.1.0-204, update to version 10.5.1-270 or 10.1.1-235 to resolve the issue. For Cisco Web Security Appliance (WSA) version 10.1.0-204, update to version 10.5.1-270 or 10.1.1-235 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6746

Affected Products

Cisco Web Security Appliance

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6746 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6746 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170719-wsa1 · Vendor Advisory
• http://securityfocus.com/bid/99877 · Note
• http://securitytracker.com/id/1038948 · Note