PT-2016-3723 · Ca · Ca Single Sign-On

Published 2016-03-24 · Updated 2021-04-09 · CVE-2015-6853

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions CA Single Sign-On versions R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, R12.52 before SP1 CR3

Description The issue allows remote attackers to cause a denial of service or obtain sensitive information via a crafted request.

Recommendations For version R6, update to a newer version to mitigate the risk. For versions R12.0 before SP3 CR13, apply SP3 CR13 or later. For versions R12.0J before SP3 CR1.2, apply SP3 CR1.2 or later. For versions R12.5 before CR5, apply CR5 or later. For versions R12.51 before CR4, apply CR4 or later. For versions R12.52 before SP1 CR3, apply SP1 CR3 or later.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2015-6853

Affected Products

Ca Single Sign-On

References · 3

• http://ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160323-01-security-notice-for-ca-single-sign-on-web-agents.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6853 · Security Note
• http://securitytracker.com/id/1035389 · Note