CVE-2017-6730
mediumPriorität · verfolgen · 22EPSS 0.017 · 77. PerzentilEUUSEPSS · bewertet 2026-10-29
A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system, aka Information Disclosure. This vulnerability affects the following products if they are running an affected release of Cisco Wide Area Application Services (WAAS) Software and are configured to use the Central Manager function: Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, Cisco Wide Area Application Services (WAAS) Modules. Only Cisco WAAS products that are configured with the Central Manager role are affected by this vulnerability. More Information: CSCvd87574. Known Affected Releases: 4.4(7) 6.2(1) 6.2(3). Known Fixed Releases: 6.3(0.228) 6.3(0.226) 6.2(3d)8 5.5(7b)17.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenCisco Wide Area Application Services (WAAS)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (5)
Betroffene Produkte und Versionsbereiche.
- cisco wide area application services= 4.4(7)nvdUScpe:2.3:a:cisco:wide_area_application_services:*:*:*:*:*:*:*:*
- cisco wide area application services= 6.2(1)nvdUScpe:2.3:a:cisco:wide_area_application_services:*:*:*:*:*:*:*:*
- cisco wide area application services= 6.2(3)nvdUScpe:2.3:a:cisco:wide_area_application_services:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- cisco-sa-20170705-waas1Cisco Wide Area Application Services Central Manager Information Disclosure Vulnerability2017-07-05csaf · cisco_csafUS
A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system. The vulnerability is due to a processing error in how the affected software applies role-based access control (RBAC) to URLs. An attacker could exploit this vulnerability by conducting a brute-force attack or guessing the report ID of a completed report and sending a crafted HTTP GET request with the ID to an affected system. A successful exploit could allow the attacker to download any completed report that was previously scheduled by a WAAS administrator via the Reports Central area in the WAAS Central Manager GUI of the affected system. There are no workarounds that address this vulnerability.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas1cnnvd
- http://www.securityfocus.com/bid/99481enisa_euvd
- http://www.securitytracker.com/id/1038825enisa_euvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas1enisa_euvd
- http://www.securityfocus.com/bid/99481Third Party AdvisoryVDB Entrynvd
- http://www.securitytracker.com/id/1038825Third Party AdvisoryVDB Entrynvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-waas1Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan