CVE-2017-12255

{"id": "CVE-2017-12255", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2017-09-21T05:29:00.840", "references": [{"url": "http://www.securityfocus.com/bid/100932", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1039412", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-ucs", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell access. The vulnerability is due to insufficient input validation of commands entered in the CLI, aka a Restricted Shell Break Vulnerability. An attacker could exploit this vulnerability by entering a specific command with crafted arguments. An exploit could allow the attacker to gain shell access to the underlying system. Cisco Bug IDs: CSCve70762."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de l\u00ednea de comandos de Cisco UCS Central Software podr\u00eda permitir que un atacante autenticado local obtenga acceso shell. La vulnerabilidad se debe a una validaci\u00f3n insuficiente de entradas de los comandos introducidos en la interfaz de l\u00ednea de comando. Esta vulnerabilidad tambi\u00e9n se conoce como \"Restricted Shell Break Vulnerability\". Un atacante podr\u00eda explotar esta vulnerabilidad introduciendo un comando espec\u00edfico con argumentos manipulados. Un exploit podr\u00eda permitir que un atacante obtenga acceso shell al sistema subyacente. Cisco Bug IDs: CSCve70762."}], "lastModified": "2019-10-09T23:22:45.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_computing_system:1.5\\(1c\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D13B4E44-9E29-49C5-9498-40D3DCEAB440"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:unified_computing_system:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "301FBC67-7946-479D-ACC5-D54CBD698291"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}