PT-2015-1637 · Cisco · Cisco Unified Communications Manager+1

Publicado 2015-07-31 · Atualizado 2015-08-21 · CVE-2015-4295

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 10.5(3.10000.9)

Description The issue is related to the Prime Collaboration Deployment component, which lacks protection of internal data. This allows a remote authenticated user to discover root credentials by making a direct request to an unspecified URL.

Recommendations For Cisco Unified Communications Manager version 10.5(3.10000.9), consider restricting access to the Prime Collaboration Deployment component until a fix is available. As a temporary workaround, limit the use of direct requests to unspecified URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-10983

CVE-2015-4295

Produtos afetados

Cisco Unified Communications Manager

Cisco Prime Collaboration Deployment

Referências · 4

• http://securitytracker.com/id/1033174 · Nota
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40223 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-4295 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10983 · Nota de Segurança