Lucene search

CiscoCVE-2017-6709

HistoryJul 06, 2017 - 12:29 a.m.

CVE-2017-6709

2017-07-0600:29:00

CWE-532

CWE-522

CWE-200

cisco

web.nvd.nist.gov

vulnerability

autovnf

cisco

ultra services framework

cve-2017-6709

remote attacker

administrative credentials

access

cisco esc

cisco openstack

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.004

Percentile

73.3%

JSON

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (ESC) and Cisco OpenStack deployments in an affected system. The vulnerability exists because the affected software logs administrative credentials in clear text for Cisco ESC and Cisco OpenStack deployment purposes. An attacker could exploit this vulnerability by accessing the AutoVNF URL for the location where the log files are stored and subsequently accessing the administrative credentials that are stored in clear text in those log files. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76659.

Affected configurations

Nvd

Node

ciscoultra_services_frameworkRange≤5.0.2

VendorProductVersionCPE
ciscoultra_services_framework*cpe:2.3:a:cisco:ultra_services_framework:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ultra_services_framework	*	cpe:2.3:a:cisco:ultra_services_framework::::::::

CNA Affected

[
  {
    "product": "Cisco Ultra Services Framework",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Ultra Services Framework"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf2

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.004

Percentile

73.3%

JSON

Related for CVE-2017-6709