Security restrictions bypass in Cisco Cloud Services Platform 2100 - CVE-2017-12251
Published: October 19, 2017
Vulnerability identifier: #VU8896
CSH Severity: High
CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2017-12251
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to bypass security restrictions.
The weakness exists in the web console of the Cisco Cloud Services Platform (CSP) 2100 due to weaknesses in the generation of certain authentication mechanisms in the URL. A remote attacker can browse to one of the hosted VMs' URLs in Cisco CSP and view specific patterns that control the web application's mechanisms for authentication control.
Successful exploitation of the vulnerability results in full control over the affected system.
The weakness exists in the web console of the Cisco Cloud Services Platform (CSP) 2100 due to weaknesses in the generation of certain authentication mechanisms in the URL. A remote attacker can browse to one of the hosted VMs' URLs in Cisco CSP and view specific patterns that control the web application's mechanisms for authentication control.
Successful exploitation of the vulnerability results in full control over the affected system.
Affected software
Cisco Cloud Services Platform 2100
How to mitigate CVE-2017-12251
Update to version 2.2.3.