CVE-2017-3851

State: Published
Severity: Not scored
Published: Mar 22, 2017
Updated: Aug 5, 2024
Reserved: Dec 21, 2016

Description

A Directory Traversal vulnerability in the web framework code of the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an unauthenticated, remote attacker to read any file from the CAF in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting crafted requests to the CAF web interface. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52302.

Scores

The record has no CVSS score.

Weaknesses

CWE-22 Directory Traversal Vulnerability

Affected Products

Product	Versions
Cisco Application-Hosting Frameworkn/a	Cisco Application-Hosting FrameworkAffected

References

97013vdb-entry
1038107vdb-entry
1038106vdb-entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.