PT-2017-17314 · Cisco · Services Controller+1

Published 2017-08-17 · Updated 2017-08-25 · CVE-2017-6778

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Ultra Services Platform version 21.0.v0.65839

Description A vulnerability in the Elastic Services Controller (ESC) web interface could allow an authenticated, remote attacker to acquire sensitive information. This is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this by sending a GET request to a vulnerable device, potentially allowing them to view information regarding the Ultra Services Platform deployment.

Recommendations For version 21.0.v0.65839, consider restricting access to the ESC web interface until a fix is available. As a temporary workaround, avoid using the GET request method to sensitive information endpoints.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-6778

Affected Products

Cisco Ultra Services Platform

Services Controller

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-usp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6778 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6778 · Vendor Advisory
• http://securityfocus.com/bid/100380 · Note