CVE-2016-9223

Опубликовано: 26 дек. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface).

Ссылки

http://www.securityfocus.com/bid/95024
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161221-cco
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/95024
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161221-cco
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:cloudcenter_orchestrator:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:cloudcenter_orchestrator:4.5.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:cloudcenter_orchestrator:4.6.0:*:*:*:*:*:*:*

cpe:2.3:a:cisco:cloudcenter_orchestrator:4.6.1:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.0175

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-r7qm-f8h2-jq46