CVE-2017-6712: OS Command Injection
A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76634.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6712?
CVE-2017-6712 is rated as high severity due to its potential for privilege escalation to root.
How do I fix CVE-2017-6712?
To fix CVE-2017-6712, upgrade to the latest version of Cisco Elastic Services Controller that is not affected by this vulnerability.
Who is affected by CVE-2017-6712?
CVE-2017-6712 affects authenticated users of Cisco Elastic Services Controller versions 1.0.0, 1.1.0, and 2.x.
What types of attacks can exploit CVE-2017-6712?
CVE-2017-6712 can be exploited by authenticated remote attackers to execute arbitrary commands with root privileges.
Is there a workaround for CVE-2017-6712?
There are no official workarounds for CVE-2017-6712, and updating the software is the recommended approach.