Lucene search

CiscoCVE-2017-12315

HistoryNov 16, 2017 - 7:29 a.m.

CVE-2017-12315

2017-11-1607:29:00

CWE-200

cisco

web.nvd.nist.gov

cve-2017-12315

system logging

vulnerability

cisco hyperflex

replication

information security

cisco bug ids

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability in system logging when replication is being configured with the Cisco HyperFlex System could allow an authenticated, local attacker to view sensitive information that should be restricted in the system log files. The attacker would have to be authenticated as an administrative user to conduct this attack. The vulnerability is due to lack of proper masking of sensitive information in system log files. An attacker could exploit this vulnerability by authenticating to the targeted device and viewing the system log file. An exploit could allow the attacker to view sensitive system information that should have been restricted. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvg31472.

Affected configurations

Nvd

Node

ciscohyperflex_hx_data_platformMatch2.6\(1a\)

VendorProductVersionCPE
ciscohyperflex_hx_data_platform2.6(1a)cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1a\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	hyperflex_hx_data_platform	2.6(1a)	cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1a\):::::::*

CNA Affected

[
  {
    "product": "Cisco HyperFlex System",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco HyperFlex System"
      }
    ]
  }
]

References

www.securityfocus.com/bid/101864

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-hyperflex

Social References

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2017-12315