PT-2015-2588 · Cisco · Cisco Secure Access Control Server

Publicado 2015-10-30 · Atualizado 2016-12-07 · CVE-2015-6348

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 5.7(0.15)

Description The issue concerns the report-generation web interface in the Solution Engine component, which has inadequate access control restrictions. This allows a remote authenticated user to bypass intended Role-Based Access Control (RBAC) restrictions. By visiting a specific web page, an attacker can read report or status information, potentially including log files and device status details.

Recommendations For Cisco Secure Access Control Server (ACS) version 5.7(0.15), consider restricting access to the report-generation web interface until a fix is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-11953

CVE-2015-6348

Produtos afetados

Cisco Secure Access Control Server

Referências · 4

• http://securitytracker.com/id/1033970 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6348 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11953 · Nota de Segurança