Lucene search

[email protected]CVE-2017-6713

HistoryJul 06, 2017 - 12:29 a.m.

CVE-2017-6713

2017-07-0600:29:00

CWE-770

CWE-264

[email protected]

web.nvd.nist.gov

cve-2017-6713

cisco

elastic services controller

esc

vulnerability

play framework

remote attacker

unauthenticated

access

static credentials

admin session token

web ui

nvd

cisco bug ids

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

JSON

A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacker who can extract the static credentials from an existing installation of Cisco ESC could generate an admin session token that allows access to all instances of the ESC web UI. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76627.

Affected configurations

NVD

Node

ciscoelastic_services_controllerMatch1.0.0

ciscoelastic_services_controllerMatch1.1.0

ciscoelastic_services_controllerMatch2.0

ciscoelastic_services_controllerMatch2.1.0

ciscoelastic_services_controllerMatch2.2.0

ciscoelastic_services_controllerMatch2.3.0

CPENameOperatorVersion
cisco:elastic_services_controllercisco elastic services controllereq1.0.0
cisco:elastic_services_controllercisco elastic services controllereq1.1.0
cisco:elastic_services_controllercisco elastic services controllereq2.0
cisco:elastic_services_controllercisco elastic services controllereq2.1.0
cisco:elastic_services_controllercisco elastic services controllereq2.2.0
cisco:elastic_services_controllercisco elastic services controllereq2.3.0

CPE	Name	Operator	Version
cisco:elastic_services_controller	cisco elastic services controller	eq	1.0.0
cisco:elastic_services_controller	cisco elastic services controller	eq	1.1.0
cisco:elastic_services_controller	cisco elastic services controller	eq	2.0
cisco:elastic_services_controller	cisco elastic services controller	eq	2.1.0
cisco:elastic_services_controller	cisco elastic services controller	eq	2.2.0
cisco:elastic_services_controller	cisco elastic services controller	eq	2.3.0

CNA Affected

[
  {
    "product": "Cisco Elastic Services Controller",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Elastic Services Controller"
      }
    ]
  }
]

References

www.securityfocus.com/bid/99437

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-esc2

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

JSON

Related for CVE-2017-6713

prion1 cisco1 cvelist1 nvd1