PT-2015-2589 · Cisco · Cisco Secure Access Control Server

Published 2015-10-30 · Updated 2016-12-07 · CVE-2015-6347

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 5.7(0.15)

Description The issue concerns a component of the Cisco Secure Access Control System, specifically the Solution Engine, which has inadequate access restrictions to certain functions. This allows a remote authenticated user to bypass intended Role-Based Access Control (RBAC) restrictions. By visiting a specific web page, an attacker can create a new dashboard or portlet.

Recommendations For Cisco Secure Access Control Server (ACS) version 5.7(0.15), consider restricting access to the Solution Engine component until a patch is available. As a temporary workaround, limit the creation of new dashboards or portlets to authorized personnel only.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-11954

CVE-2015-6347

Affected Products

Cisco Secure Access Control Server

References · 4

• https://bdu.fstec.ru/vul/2015-11954 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151023-acs_rbac · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6347 · Security Note
• http://securitytracker.com/id/1033971 · Note