PT-2015-4800 · Cisco · Cisco Mobility Services Engine

Published 2015-03-26 · Updated 2015-09-04 · CVE-2015-0673

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Mobility Services Engine (MSE) version 8.0(110.0)

Description The issue allows remote authenticated users to discover the passwords of arbitrary users. This can be achieved by either reading log files or using an unspecified GUI feature.

Recommendations For Cisco Mobility Services Engine (MSE) version 8.0(110.0), consider restricting access to log files and the unspecified GUI feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-0673

Affected Products

Cisco Mobility Services Engine

References · 3

• http://tools.cisco.com/security/center/viewAlert.x?alertId=38007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0673 · Security Note
• http://securitytracker.com/id/1031971 · Note