Directory Traversal Vulnerability in Cisco IOx Application Hosting Framework
CVE-2017-3851

7.5HIGH

Key Information:

Vendor
Cisco
Status
Cisco Application-hosting Framework
Vendor
CVE Published:
22 March 2017

Summary

A Directory Traversal vulnerability exists in the web framework code of the Cisco application-hosting framework (CAF), allowing an unauthenticated remote attacker to access and read any file within the CAF that runs inside the virtual instance on the affected Cisco device. This vulnerability stems from insufficient input validation and can be exploited by sending specially crafted requests to the CAF web interface. While the executed attack is confined to the virtual instance, it poses significant risks to data integrity and confidentiality. The impacted versions include Cisco IOx Releases 1.0.0.0 and 1.1.0.0, as identified in Cisco Bug IDs: CSCuy52302.

Affected Version(s)

Cisco Application-Hosting Framework Cisco Application-Hosting Framework

References

http://www.securityfocus.com/bid/97013
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1038107
vdb-entryx_refsource_SECTRACK
http://www.securitytracker.com/id/1038106
vdb-entryx_refsource_SECTRACK

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.