====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN288
_____________________________________________________________________

DATE                : 05/10/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco License Manager.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-clm
____________________________________________________________________

Cisco Security Advisory: Cisco License Manager Directory Traversal
Information Disclosure Vulnerability

Advisory ID: cisco-sa-20171004-clm

Revision: 1.0

For Public Release: 2017 October 4 16:00 GMT

Last Updated: 2017 October 4 16:00 GMT

CVE ID(s): CVE-2017-12263

CVSS Score v(3): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

+---------------------------------------------------------------------

Summary
=======
A vulnerability in the web interface of Cisco License Manager software
could allow an unauthenticated, remote attacker to download and view
files within the application which should be restricted.

The issue is due to improper sanitization of user-supplied input in
HTTP request parameters that describe filenames. An attacker could
exploit this vulnerability by using directory traversal techniques to
submit a path to a desired file location. An exploit could allow the
attacker to view application files which may contain sensitive
information.

Cisco has not released and will not release a software update to
address this vulnerability. There are no workarounds that address this
vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-clm
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-clm"]

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================