CVE-2017-6777

MEDIUM

Cisco Elastic Services Controller 2.3-2.3(2) - Authenticated Sensitive Information Exposure via ConfD Server

Title source: llm

Description

A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerability by logging into the ConfD server and executing certain commands. An exploit could allow an unprivileged user to view configuration parameters that can be maliciously used. Cisco Bug IDs: CSCvd76409. Known Affected Releases: 2.3, 2.3(2).

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory x_refsource_cisco

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-esc3

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/100390

Scores

CVSS v3 4.9

EPSS 0.0122

EPSS Percentile 64.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (3)

cisco/elastic_services_controller 2.3

cisco/elastic_services_controller 2.3\(2\)

Cisco Systems, Inc./Elastic Services Controller 2.3, 2.3(2)

Published Aug 17, 2017

Tracked Since Feb 18, 2026