CVE-2017-6772

MEDIUM

Cisco Elastic Services Controller 2.3(2) - Authenticated Sensitive Information Exposure via Configuration Files

Title source: llm

Description

A vulnerability in Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and navigating to certain configuration files. An exploit could allow the attacker to view sensitive system configuration files. Cisco Bug IDs: CSCvd29408. Known Affected Releases: 2.3(2).

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/100388

Vendor Advisory vendor-advisory x_refsource_cisco

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc1

Scores

CVSS v3 4.3

EPSS 0.0094

EPSS Percentile 56.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

cisco/elastic_services_controller 2.3\(2\)

Cisco Systems, Inc./Elastic Services Controller 2.3(2)

Published Aug 17, 2017

Tracked Since Feb 18, 2026