PT-2015-2589 · Cisco · Cisco Secure Access Control Server

Publicado 2015-10-30 · Atualizado 2016-12-07 · CVE-2015-6347

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 5.7(0.15)

Description The issue concerns a component of the Cisco Secure Access Control System, specifically the Solution Engine, which has inadequate access restrictions to certain functions. This allows a remote authenticated user to bypass intended Role-Based Access Control (RBAC) restrictions. By visiting a specific web page, an attacker can create a new dashboard or portlet.

Recommendations For Cisco Secure Access Control Server (ACS) version 5.7(0.15), consider restricting access to the Solution Engine component until a patch is available. As a temporary workaround, limit the creation of new dashboards or portlets to authorized personnel only.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-11954

CVE-2015-6347

Produtos afetados

Cisco Secure Access Control Server

Referências · 4

• https://bdu.fstec.ru/vul/2015-11954 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac · Aviso do Fabricante
• http://securitytracker.com/id/1033971 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6347 · Nota de Segurança