PT-2016-3724 · Ca · Ca Single Sign-On

Published 2016-03-24 · Updated 2021-04-09 · CVE-2015-6854

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions CA Single Sign-On versions R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5

Description The issue allows remote attackers to cause a denial of service or obtain sensitive information via a crafted request. This is related to the non-Domino web agents in CA Single Sign-On.

Recommendations For version R6, update to a version later than R6 to resolve the issue. For versions R12.0 before SP3 CR13, apply SP3 CR13 or later to resolve the issue. For versions R12.0J before SP3 CR1.2, apply SP3 CR1.2 or later to resolve the issue. For versions R12.5 before CR5, apply CR5 or later to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2015-6854

Affected Products

Ca Single Sign-On

References · 3

• http://ca.com/us/support/ca-support-online/product-content/recommended-reading/security-notices/ca20160323-01-security-notice-for-ca-single-sign-on-web-agents.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6854 · Security Note
• http://securitytracker.com/id/1035389 · Note