PT-2015-2588 · Cisco · Cisco Secure Access Control Server

Published 2015-10-30 · Updated 2016-12-07 · CVE-2015-6348

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 5.7(0.15)

Description The issue concerns the report-generation web interface in the Solution Engine component, which has inadequate access control restrictions. This allows a remote authenticated user to bypass intended Role-Based Access Control (RBAC) restrictions. By visiting a specific web page, an attacker can read report or status information, potentially including log files and device status details.

Recommendations For Cisco Secure Access Control Server (ACS) version 5.7(0.15), consider restricting access to the report-generation web interface until a fix is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-11953

CVE-2015-6348

Affected Products

Cisco Secure Access Control Server

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6348 · Security Note
• https://bdu.fstec.ru/vul/2015-11953 · Security Note
• http://securitytracker.com/id/1033970 · Note