PT-2017-17313 · Tail F Systems+1 · Confd Server+1

Published 2017-08-17 · Updated 2017-08-22 · CVE-2017-6777

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controller (ESC) versions 2.3 through 2.3(2)

Description A vulnerability in the ConfD server could allow an authenticated, remote attacker to acquire sensitive system information due to insufficient protection of sensitive files on the system. An attacker could exploit this by logging into the ConfD server and executing certain commands, potentially allowing an unprivileged user to view configuration parameters that can be maliciously used.

Recommendations For versions 2.3 and 2.3(2), consider restricting access to the ConfD server to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the execution of certain commands on the ConfD server to prevent unauthorized access to sensitive system information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-6777

Affected Products

Cisco Elastic Services Controller

Confd Server

References · 4

• https://osv.dev/vulnerability/CVE-2017-6777 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6777 · Security Note
• http://securityfocus.com/bid/100390 · Note