Lucene search

CiscoCVE-2017-6752

HistoryAug 07, 2017 - 6:29 a.m.

CVE-2017-6752

2017-08-0706:29:00

CWE-200

cisco

web.nvd.nist.gov

cisco

asa

vulnerability

web interface

remote attacker

usernames

ldap

ssl

exploit

nvd

cve-2017-6752

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the interaction between Lightweight Directory Access Protocol (LDAP) and SSL Connection Profile when they are configured together. An attacker could exploit the vulnerability by performing a username enumeration attack to the IP address of the device. An exploit could allow the attacker to determine valid usernames. Cisco Bug IDs: CSCvd47888.

Affected configurations

Nvd

Node

ciscoadaptive_security_appliance_softwareMatch9.3.3

ciscoadaptive_security_appliance_softwareMatch9.6.2

VendorProductVersionCPE
ciscoadaptive_security_appliance_software9.3.3cpe:2.3:o:cisco:adaptive_security_appliance_software:9.3.3:*:*:*:*:*:*:*
ciscoadaptive_security_appliance_software9.6.2cpe:2.3:o:cisco:adaptive_security_appliance_software:9.6.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	adaptive_security_appliance_software	9.3.3	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.3.3:::::::*
cisco	adaptive_security_appliance_software	9.6.2	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.6.2:::::::*

CNA Affected

[
  {
    "product": "Cisco Adaptive Security Appliance",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Adaptive Security Appliance"
      }
    ]
  }
]

References

www.securityfocus.com/bid/100113

www.securitytracker.com/id/1039057

quickview.cloudapps.cisco.com/quickview/bug/CSCvd47888

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-asa2

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

Related for CVE-2017-6752