CVE-2017-6712 | BDVDB-2026-87344 Detail

Cisco Elastic Services Controller

Description#

A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76634.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References#

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-esc1
http://www.securityfocus.com/bid/99461

Exploit#

No public exploit known

History#

Version 12017-07-06Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.