PT-2017-2759 · Cisco · Cisco Elastic Services Controller

Published 2017-06-13 · Updated 2017-06-23 · CVE-2017-6683

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controllers version 2.2(9.76)

Description A vulnerability in the esc listener.py script could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system. The issue arises due to the lack of neutralization of special elements used in the operating system command.

Recommendations For version 2.2(9.76), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2017-02008

CVE-2017-6683

Affected Products

Cisco Elastic Services Controller

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6683 · Security Note
• https://bdu.fstec.ru/vul/2017-02008 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6683 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esc2 · Vendor Advisory
• http://securityfocus.com/bid/98982 · Note