PT-2015-2587 · Cisco · Cisco Secure Access Control Server

Published 2015-10-30 · Updated 2016-12-07 · CVE-2015-6349

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 5.7(0.15)

Description The issue exists due to insufficient protection of the web page structure in the Solution Engine component of the Cisco Secure Access Control System. This allows a remote attacker to execute arbitrary web or HTML code using a specially crafted URL. The vulnerability can be exploited to inject arbitrary web script or HTML via a crafted URL, which is a type of cross-site scripting (XSS) attack.

Recommendations For Cisco Secure Access Control Server (ACS) version 5.7(0.15), consider restricting access to the web interface until a patch is available. As a temporary workaround, avoid using specially crafted URLs that could exploit the vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11952

CVE-2015-6349

Affected Products

Cisco Secure Access Control Server

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_xss1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6349 · Security Note
• https://bdu.fstec.ru/vul/2015-11952 · Security Note
• http://securitytracker.com/id/1033968 · Note