Lucene search

CiscoCVE-2017-3851

HistoryMar 22, 2017 - 7:59 p.m.

CVE-2017-3851

2017-03-2219:59:00

CWE-22

cisco

web.nvd.nist.gov

cisco

iox

vulnerability

cve-2017-3851

directory traversal

web framework

caf

remote attacker

input validation

cisco bug id

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

68.4%

JSON

A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an unauthenticated, remote attacker to read any file from the CAF in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting crafted requests to the CAF web interface. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52302.

Affected configurations

Nvd

Node

ciscoioxMatch1.1\(0\)

ciscoioxMatch1.1.0

VendorProductVersionCPE
ciscoiox1.1(0)cpe:2.3:a:cisco:iox:1.1\(0\):*:*:*:*:*:*:*
ciscoiox1.1.0cpe:2.3:a:cisco:iox:1.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	iox	1.1(0)	cpe:2.3:a:cisco:iox:1.1\(0\):::::::*
cisco	iox	1.1.0	cpe:2.3:a:cisco:iox:1.1.0:::::::*

CNA Affected

[
  {
    "product": "Cisco Application-Hosting Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Application-Hosting Framework"
      }
    ]
  }
]

References

www.securityfocus.com/bid/97013

www.securitytracker.com/id/1038106

www.securitytracker.com/id/1038107

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf1

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

68.4%

JSON

Related for CVE-2017-3851