Information Disclosure in Cisco Elastic Services Controller
CVE-2017-6772

4.3MEDIUM

Key Information:

Vendor
Cisco
Status
Elastic Services Controller
Vendor
CVE Published:
17 August 2017

Summary

A vulnerability in Cisco's Elastic Services Controller allows authenticated remote attackers to access sensitive system configuration files. This weakness stems from inadequate protection of sensitive data, enabling an attacker to exploit the situation after authenticating to the application and navigating to specific configuration paths. This could lead to exposure of critical system information, potentially compromising system integrity and security.

Affected Version(s)

Elastic Services Controller 2.3(2)

References

http://www.securityfocus.com/bid/100388
vdb-entryx_refsource_BID
https://tools.cisco.com/security/center/content/CiscoSecu...
vendor-advisoryx_refsource_CISCO

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.