Sign-up

ID

VAR-201709-0698


CVE

CVE-2017-12229


TITLE

Cisco IOS XE Authentication vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-008498

DESCRIPTION

A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious API request to an affected device. A successful exploit could allow the attacker to bypass authentication and gain access to the web UI of the affected software. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration UI was introduced in the Denali 16.2 Release of Cisco IOS XE Software. This vulnerability does not affect the web-based administration UI in earlier releases of Cisco IOS XE Software. Cisco Bug IDs: CSCuz46036. Vendors have confirmed this vulnerability Bug ID CSCuz46036 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This may lead to further attacks

Trust: 2.07

sources: NVD: CVE-2017-12229 // JVNDB: JVNDB-2017-008498 // BID: 101032 // VULHUB: VHN-102730 // VULMON: CVE-2017-12229

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:16.1.3

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.2.1xo

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.4.7asg

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:16.1.1

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.2.0ja

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:16.1.2

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.8.0ex

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.1.3as

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.6.5be

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.3vs

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:16.1.4

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.2.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.2.2a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.5.1c

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.5.1a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.3.1a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:16.1.3a

Trust: 1.0

vendor:ciscomodel:ios xescope: - version: -

Trust: 0.8

vendor:ciscomodel:ios xe softwarescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:16.2

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:16.1.2

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:16.3(0)

Trust: 0.3

vendor:ciscomodel:iosscope:neversion:16.4.1

Trust: 0.3

vendor:ciscomodel:ios everest-16.4.1scope:neversion: -

Trust: 0.3

vendor:ciscomodel:iosscope:neversion:16.4(0.37)

Trust: 0.3

vendor:ciscomodel:iosscope:neversion:16.3(1)

Trust: 0.3

vendor:ciscomodel:iosscope:neversion:16.3(0.214)

Trust: 0.3

vendor:ciscomodel:iosscope:neversion:16.2(1.25)

Trust: 0.3

sources: BID: 101032 // JVNDB: JVNDB-2017-008498 // CNNVD: CNNVD-201709-1305 // NVD: CVE-2017-12229

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-12229
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-12229
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201709-1305
value: CRITICAL

Trust: 0.6

VULHUB: VHN-102730
value: HIGH

Trust: 0.1

VULMON: CVE-2017-12229
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-12229
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-102730
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-12229
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-102730 // VULMON: CVE-2017-12229 // JVNDB: JVNDB-2017-008498 // CNNVD: CNNVD-201709-1305 // NVD: CVE-2017-12229

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-102730 // JVNDB: JVNDB-2017-008498 // NVD: CVE-2017-12229

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-1305

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201709-1305

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-008498

PATCH
title:cisco-sa-20170927-restapiurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi
Trust: 0.8
title:Cisco IOS XE Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=75190
Trust: 0.6
title:Cisco: Cisco IOS XE Software Web UI REST API Authentication Bypass Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20170927-restapi
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-12229 // 
            
            
            
            JVNDB: JVNDB-2017-008498 // 
            
            
            
            CNNVD: CNNVD-201709-1305

EXTERNAL IDS
db:NVDid:CVE-2017-12229
Trust: 2.9
db:BIDid:101032
Trust: 2.1
db:SECTRACKid:1039447
Trust: 1.8
db:JVNDBid:JVNDB-2017-008498
Trust: 0.8
db:CNNVDid:CNNVD-201709-1305
Trust: 0.7
db:VULHUBid:VHN-102730
Trust: 0.1
db:VULMONid:CVE-2017-12229
Trust: 0.1
sources:
            
            
            VULHUB: VHN-102730 // 
            
            
            
            VULMON: CVE-2017-12229 // 
            
            
            
            BID: 101032 // 
            
            
            
            JVNDB: JVNDB-2017-008498 // 
            
            
            
            CNNVD: CNNVD-201709-1305 // 
            
            
            
            NVD: CVE-2017-12229

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170927-restapi
Trust: 2.2
url:http://www.securityfocus.com/bid/101032
Trust: 1.9
url:http://www.securitytracker.com/id/1039447
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12229
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-12229
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/287.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-102730 // 
            
            
            
            VULMON: CVE-2017-12229 // 
            
            
            
            BID: 101032 // 
            
            
            
            JVNDB: JVNDB-2017-008498 // 
            
            
            
            CNNVD: CNNVD-201709-1305 // 
            
            
            
            NVD: CVE-2017-12229

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 101032

SOURCES
db:VULHUBid:VHN-102730
db:VULMONid:CVE-2017-12229
db:BIDid:101032
db:JVNDBid:JVNDB-2017-008498
db:CNNVDid:CNNVD-201709-1305
db:NVDid:CVE-2017-12229

LAST UPDATE DATE
2024-11-23T23:02:21.597000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-102730date:2019-10-09T00:00:00
db:VULMONid:CVE-2017-12229date:2019-10-09T00:00:00
db:BIDid:101032date:2017-09-27T00:00:00
db:JVNDBid:JVNDB-2017-008498date:2017-10-20T00:00:00
db:CNNVDid:CNNVD-201709-1305date:2019-10-17T00:00:00
db:NVDid:CVE-2017-12229date:2024-11-21T03:09:04.917

SOURCES RELEASE DATE
db:VULHUBid:VHN-102730date:2017-09-29T00:00:00
db:VULMONid:CVE-2017-12229date:2017-09-29T00:00:00
db:BIDid:101032date:2017-09-27T00:00:00
db:JVNDBid:JVNDB-2017-008498date:2017-10-20T00:00:00
db:CNNVDid:CNNVD-201709-1305date:2017-09-28T00:00:00
db:NVDid:CVE-2017-12229date:2017-09-29T01:34:48.670