CVE-2017-6696
published 2017-06-13CVE-2017-6696: A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user…
PriorityP425medium5.5CVSS 3.0
AVLACLPRLUINSUCHINAN
EPSS
0.31%
22.5th percentile
A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user credentials that are stored in an affected system. More Information: CSCvd73677. Known Affected Releases: 2.3(2).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | elastic_services_controller | — | — |
| cisco | elastic_services_controller_user_credentials | — | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Elastic Services Controller User Credentials Information Disclosure Vulnerability
vendor_cisco·2017-06-07·CVSS 5.5
CVE-2017-6696 [MEDIUM] CWE-200 Cisco Elastic Services Controller User Credentials Information Disclosure Vulnerability
Cisco Elastic Services Controller User Credentials Information Disclosure Vulnerability
A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive credentials that are stored in an affected system.
The vulnerability exists because the affected software does not sufficiently control access to the credential repository on an affected system. An attacker could exploit this vulnerability by accessing certain files on an affected system via the command line. A successful exploit could allow the attacker to retrieve sensitive user credentials from the affected system.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/
Cisco
Cisco Elastic Services Controller User Credentials Information Disclosure Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-6696 Cisco Elastic Services Controller User Credentials Information Disclosure Vulnerability
CVE-2017-6696: Cisco Elastic Services Controller User Credentials Information Disclosure Vulnerability
A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive credentials that are stored in an affected system. The vulnerability exists because the affected software does not sufficiently control access to the credential repository on an affected system. An attacker could exploit this vulnerability by accessing certain files on an affected system via the command line. A successful exploit could allow the attacker to retrieve sensitive user credentials from the affected system. There are no
CVSS: 3.0
CWE: CWE-200, CWE-200
Bug IDs: CSCvd73677
GHSA
GHSA-2vwh-gpg3-5pm3: A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user
ghsa_unreviewed·2022-05-17
CVE-2017-6696 [MEDIUM] CWE-200 GHSA-2vwh-gpg3-5pm3: A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user
A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user credentials that are stored in an affected system. More Information: CSCvd73677. Known Affected Releases: 2.3(2).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-06-13
Published