Cisco Ultra Services Framework vulnerabilities

CVE-2017-6709 [CRITICAL] CWE-200 CVE-2017-6709: A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenti A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (ESC) and Cisco OpenStack deployments in an affected system. The vulnerability exists because the affected software logs administrative credentials in cl

CVE-2017-6708 [CRITICAL] CWE-200 CVE-2017-6708: A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Ci A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create sym

CVE-2017-6711 [CRITICAL] CWE-287 CVE-2017-6711: A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could al A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device. The vulnerability is due to an insecure default configuration of the Apache ZooKeeper service used by the affected software. An attacker could exploit this vulne

CVE-2017-6681 [HIGH] CWE-22 CVE-2017-6681: A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to execute a relative path traversal attack, enabling an attacker to read sensitive files on the system. More Information: CSCvc76662. Known Affected Releases: 21.0.0.

CVE-2017-6771 [HIGH] CWE-200 CVE-2017-6771: A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to acquire sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by browsing to a specific URL of an affected device. An exploit could all

CVE-2017-6680 [HIGH] CWE-20 CVE-2017-6680: A vulnerability in the AutoVNF logging function of Cisco Ultra Services Framework could allow an una A vulnerability in the AutoVNF logging function of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to create arbitrary directories on the affected system. More Information: CSCvc76652. Known Affected Releases: 21.0.0.