PT-2016-6909 · Cisco · Cisco Firepower Management Center

Matt Bergin + 1 · Publicado 2016-10-06 · Atualizado 2024-11-26 · CVE-2016-6435

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Firepower Management Center version 6.0.1

Description The issue allows remote authenticated users to read arbitrary files via crafted parameters.

Recommendations For Cisco Firepower Management Center version 6.0.1, consider restricting access to the web console until a patch is available. Avoid using crafted parameters in the web console to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-6435

Produtos afetados

Cisco Firepower Management Center

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cisco_firepower_download.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40464 · Exploit
• https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking · Nota
• http://securityfocus.com/bid/93421 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6435 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-6435 · Aviso do Fabricante
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc2 · Aviso do Fabricante
• https://korelogic.com/Resources/Advisories/KL-001-2016-006.txt · Nota