PT-2015-1637 · Cisco · Cisco Unified Communications Manager+1

Published 2015-07-31 · Updated 2015-08-21 · CVE-2015-4295

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 10.5(3.10000.9)

Description The issue is related to the Prime Collaboration Deployment component, which lacks protection of internal data. This allows a remote authenticated user to discover root credentials by making a direct request to an unspecified URL.

Recommendations For Cisco Unified Communications Manager version 10.5(3.10000.9), consider restricting access to the Prime Collaboration Deployment component until a fix is available. As a temporary workaround, limit the use of direct requests to unspecified URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-10983

CVE-2015-4295

Affected Products

Cisco Unified Communications Manager

Cisco Prime Collaboration Deployment

References · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=40223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4295 · Security Note
• https://bdu.fstec.ru/vul/2015-10983 · Security Note
• http://securitytracker.com/id/1033174 · Note