PT-2015-6509 · Cisco · Cisco Unified Web/E-Mail Interaction Manager

Published 2015-08-19 · Updated 2016-12-28 · CVE-2015-4298

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified Web and E-Mail Interaction Manager versions 9.0(2) and 11.0(1)

Description The issue is related to improper authorization, allowing remote authenticated users to read or write to stored data.

Recommendations For version 9.0(2), update to a version that properly performs authorization. For version 11.0(1), update to a version that properly performs authorization. As a temporary workaround, consider restricting access to sensitive data until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-4298

Affected Products

Cisco Unified Web/E-Mail Interaction Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-4298 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40428 · Vendor Advisory
• http://securitytracker.com/id/1033286 · Note
• http://securityfocus.com/bid/76348 · Note