CVE-2017-12352

{"id": "CVE-2017-12352", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2017-11-30T09:29:01.027", "references": [{"url": "http://www.securityfocus.com/bid/101993", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1039925", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-apic", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authenticated, local attacker to gain elevated privileges and execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-controlled input that is supplied to certain script files of an affected system. An attacker could exploit this vulnerability by submitting crafted input to a script file on an affected system. A successful exploit could allow the attacker to gain elevated privileges and execute arbitrary commands with root privileges on the affected system. To exploit this vulnerability, the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf57274."}, {"lang": "es", "value": "Una vulnerabilidad en determinados archivos script del sistema que est\u00e1n instalados en tiempo de arranque en Cisco Application Policy Infrastructure Controllers podr\u00eda permitir que un atacante local autenticado obtenga privilegios elevados y ejecute comandos arbitrarios con privilegios root en un host del sistema operativo afectado. La vulnerabilidad se debe a la validaci\u00f3n insuficiente de entradas controladas por el usuario proporcionadas a ciertos archivos script de un dispositivo afectado. Un atacante podr\u00eda explotar esta vulnerabilidad enviando entradas manipuladas a un archivo script de un dispositivo afectado. Un exploit con \u00e9xito podr\u00eda permitir que el atacante obtenga privilegios elevados y ejecute comandos arbitrarios con privilegios root en el sistema afectado. Para explotar esta vulnerabilidad, el atacante necesitar\u00eda autenticarse en el sistema afectado empleando credenciales de administrador v\u00e1lidas. Cisco Bug IDs: CSCvf57274."}], "lastModified": "2019-10-09T23:23:00.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:application_policy_infrastructure_controller:2.3\\(1f\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "956BE54B-D4BF-472E-BA3C-3A5D62B07478"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}