CVE-2017-6772

MEDIUM

Cisco ESC <2.3.2 - Info Disclosure

Title source: llm

Description

A vulnerability in Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and navigating to certain configuration files. An exploit could allow the attacker to view sensitive system configuration files. Cisco Bug IDs: CSCvd29408. Known Affected Releases: 2.3(2).

References (2)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/100388

[Vendor Advisory] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc1

Scores

CVSS v3 4.3

EPSS 0.0015

EPSS Percentile 35.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

cisco/elastic_services_controller

Cisco Systems, Inc./Elastic Services Controller < 2.3(2)

Published Aug 17, 2017

Tracked Since Feb 18, 2026