CVEvulnerability

CVE-2017-6712

8.8 HIGH Published 2017-07-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-07-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-78

Description

A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76634.

Affected configurations

• cisco elastic services controller 1.0.0 • cisco elastic services controller 1.1.0 • cisco elastic services controller 2.0 • cisco elastic services controller 2.1.0 • cisco elastic services controller 2.2.0 • cisco elastic services controller 2.3.0

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References