CVE-2017-6712
published 2017-07-06CVE-2017-6712: A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run…
PriorityP355high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
2.05%
78.9th percentile
A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76634.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | elastic_services_controller | — | — |
| cisco | elastic_services_controller | — | — |
| cisco | elastic_services_controller | — | — |
| cisco | elastic_services_controller | — | — |
| cisco | elastic_services_controller | — | — |
| cisco | elastic_services_controller | — | — |
| cisco | elastic_services_controller | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v4w7-98vm-rrmr: A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root a
ghsa_unreviewed·2022-05-17
CVE-2017-6712 [HIGH] CWE-78 GHSA-v4w7-98vm-rrmr: A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root a
A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76634.
Cisco
Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability
vendor_cisco·2017-07-05·CVSS 8.8
CVE-2017-6712 [HIGH] CWE-78 Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability
Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability
A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server.
The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. An exploit could allow an authenticated, remote attacker to elevate privileges and run dangerous commands on the server.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/cent
Cisco
Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-6712 Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability
CVE-2017-6712: Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability
A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root . An exploit could allow an authenticated, remote attacker to elevate privileges and run dangerous commands on the server. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-78, CWE-78
Bug IDs: CSCvc76634
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-07-06
Published