CVE-2017-6710

{"id": "CVE-2017-6710", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 9.2, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2017-08-17T20:29:00.370", "references": [{"url": "http://www.securityfocus.com/bid/100362", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-em", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Cisco Virtual Network Function (VNF) Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to specify arbitrary commands that will run as root on the server. An attacker could use this setting to elevate privileges and run commands in the context of the root user on the server. Cisco Bug IDs: CSCvc76670. Known Affected Releases: prior to 5.0.4 and 5.1.4."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco Virtual Network Function (VNF) Element Manager podr\u00eda permitir que un atacante remoto autenticado elevase privilegios y ejecutase comandos en el contexto del usuario root en el servidor. Esta vulnerabilidad se debe a la configuraci\u00f3n de comandos que permite a los usuarios de Cisco VNF Element Manager especificar comandos arbitrarios que se ejecutar\u00e1n como root en el servidor. Un atacante podr\u00eda emplear esta configuraci\u00f3n para elevar privilegios y ejecutar comandos en el contexto del usuario root en el servidor. Cisco Bug IDs: CSCvc76670. Versiones afectadas conocidas: anteriores a la 5.0.4 y 5.1.4"}], "lastModified": "2017-08-25T11:04:55.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:virtual_network_function_element_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF9B8506-3299-4441-A13A-D7BE4D840689", "versionEndIncluding": "5.1.3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:virtual_network_function_element_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA0EA90E-C0E1-4ECE-83E0-4CC1BDE3C2A7", "versionEndIncluding": "5.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}