CVE-2017-6713

CWE-264CWE-770 — Allocation without Limits4 documents4 sources
Severity
9.8CRITICAL
EPSS
1.7%
top 17.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Elastic Services Controller
Timeline
PublishedJul 6
Latest updateMay 13

Description

A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacker who can extract the static credentials from an existing installation of Cisco ESC could generate an admin session token that allows access to all instances of the ESC web UI. This vulnerability affec…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5cisco_elastic_services_controllerCisco Elastic Services Controller

🔴Vulnerability Details

2
GHSA
GHSA-96vr-63hc-8mgg: A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access t↗2022-05-13
▶
CVEList
CVE-2017-6713: A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access t↗2017-07-06
▶

📋Vendor Advisories

1
Cisco
Cisco Elastic Services Controller Unauthorized Access Vulnerability↗2017-07-05
▶
CVE-2017-6713 (CRITICAL CVSS 9.8) | A vulnerability in the Play Framewo | cvebase.io