CVE-2017-3846

Name of the Vulnerable Software and Affected Versions Cisco Workload Automation Client Manager Server versions 6.3.0.116 and later Cisco Tidal Enterprise Scheduler Client Manager Server versions 6.2.1.435 and later

Description The issue is caused by insufficient input validation, allowing an unauthenticated, remote attacker to retrieve any file from the Client Manager Server by sending a crafted URL. This could enable the attacker to access sensitive information.

Recommendations For Cisco Workload Automation Client Manager Server versions 6.3.0.116 and later, update to a version that includes the fix for this issue. For Cisco Tidal Enterprise Scheduler Client Manager Server versions 6.2.1.435 and later, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Client Manager Server to minimize the risk of exploitation.