VAR-201612-0484
Vulnerability from variot - Updated: 2025-04-13 23:21A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface). Cisco CloudCenter Orchestrator is prone to a privilege-escalation vulnerability. An attacker may exploit this issue to gain root privileges on the affected device; this can also result in the attacker gaining complete control of the affected system. Cisco CloudCenter is a set of hybrid cloud management platform solutions from Cisco. The solution supports application migration, DevOps automation across multiple cloud environments, and dynamic expansion within or between clouds. Orchestrator is an orchestrator component used in it. Docker Engine is one of the container engine extensions. The vulnerability is caused by the incorrect configuration file of the program
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201612-0484",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cloudcenter orchestrator",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.5.0"
},
{
"model": "cloudcenter orchestrator",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.6.1"
},
{
"model": "cloudcenter orchestrator",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.6.0"
},
{
"model": "cloudcenter orchestrator",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.4.0"
},
{
"model": "cloudcenter orchestrator",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "all releases"
},
{
"model": "cloudcenter orchestrator",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "cloudcenter orchestrator",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "4.6.2"
}
],
"sources": [
{
"db": "BID",
"id": "95024"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
},
{
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:cisco:cloudcenter_orchestrator",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco",
"sources": [
{
"db": "BID",
"id": "95024"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
}
],
"trust": 0.9
},
"cve": "CVE-2016-9223",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2016-9223",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-98043",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-9223",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-9223",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2016-9223",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201612-622",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-98043",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2016-9223",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98043"
},
{
"db": "VULMON",
"id": "CVE-2016-9223"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
},
{
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface). Cisco CloudCenter Orchestrator is prone to a privilege-escalation vulnerability. \nAn attacker may exploit this issue to gain root privileges on the affected device; this can also result in the attacker gaining complete control of the affected system. Cisco CloudCenter is a set of hybrid cloud management platform solutions from Cisco. The solution supports application migration, DevOps automation across multiple cloud environments, and dynamic expansion within or between clouds. Orchestrator is an orchestrator component used in it. Docker Engine is one of the container engine extensions. The vulnerability is caused by the incorrect configuration file of the program",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-9223"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "BID",
"id": "95024"
},
{
"db": "VULHUB",
"id": "VHN-98043"
},
{
"db": "VULMON",
"id": "CVE-2016-9223"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-9223",
"trust": 2.9
},
{
"db": "BID",
"id": "95024",
"trust": 2.1
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-98043",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-9223",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98043"
},
{
"db": "VULMON",
"id": "CVE-2016-9223"
},
{
"db": "BID",
"id": "95024"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
},
{
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"id": "VAR-201612-0484",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-98043"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T23:21:03.708000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-20161221-cco",
"trust": 0.8,
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161221-cco"
},
{
"title": "Cisco CloudCenter Orchestrator Docker Engine Fixing security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66644"
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/cisco-critical-update-phishing-webex/154585/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-9223"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98043"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20161221-cco"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/95024"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9223"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-9223"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/264.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://threatpost.com/cisco-critical-update-phishing-webex/154585/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-98043"
},
{
"db": "VULMON",
"id": "CVE-2016-9223"
},
{
"db": "BID",
"id": "95024"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
},
{
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-98043"
},
{
"db": "VULMON",
"id": "CVE-2016-9223"
},
{
"db": "BID",
"id": "95024"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
},
{
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-26T00:00:00",
"db": "VULHUB",
"id": "VHN-98043"
},
{
"date": "2016-12-26T00:00:00",
"db": "VULMON",
"id": "CVE-2016-9223"
},
{
"date": "2016-12-21T00:00:00",
"db": "BID",
"id": "95024"
},
{
"date": "2017-01-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"date": "2016-12-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201612-622"
},
{
"date": "2016-12-26T08:59:00.207000",
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-01-03T00:00:00",
"db": "VULHUB",
"id": "VHN-98043"
},
{
"date": "2017-01-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-9223"
},
{
"date": "2017-01-12T00:04:00",
"db": "BID",
"id": "95024"
},
{
"date": "2017-01-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-006515"
},
{
"date": "2017-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201612-622"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-9223"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco CloudCenter Orchestrator of Docker Engine Have high authority in Docker Vulnerability to install containers",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-006515"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201612-622"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…