PT-2015-4780 · Cisco · Cisco 4710 Application Control Engine+2

Publicado 2015-02-27 · Atualizado 2015-11-02 · CVE-2015-0651

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Application Networking Manager (ANM) (affected versions not specified) Cisco Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances (affected versions not specified)

Description A cross-site request forgery (CSRF) issue in the web GUI of the affected products allows remote attackers to hijack the authentication of arbitrary users.

Recommendations For Cisco Application Networking Manager (ANM), update to a version that includes the fix for Bug ID CSCuo99753. For Cisco Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, update to a version that includes the fix for Bug ID CSCuo99753. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-0651

Produtos afetados

Cisco 4710 Application Control Engine

Cisco Application Networking Manager

Cisco Device Manager

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0651 · Aviso do Fabricante
• http://securitytracker.com/id/1031815 · Nota
• http://securityfocus.com/bid/72796 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-0651 · Nota de Segurança