Executive Summary
Summary | |
---|---|
Title | Cisco ASA-CX and Cisco Prime Security Manager Privilege Escalation Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20160203-prsm | First vendor Publication | 2016-02-03 |
Vendor | Cisco | Last vendor Modification | 2016-02-03 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:S/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 8.5 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 6.8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the role-based access control of Cisco ASA-CX and Cisco Prime Security Manager (PRSM) could allow an authenticated, remote attacker to change the password of any user on the system. The vulnerability exists because the password change request is not fully qualified. An authenticated attacker with a user role other than Administrator could exploit this vulnerability by sending a specially crafted HTTP request to the Cisco PRSM. An exploit could allow the attacker to change the password of any user on the system, including users with the Administrator role. Cisco has released software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-prsm BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS) iQIVAwUBVrChQq89gD3EAJB5AQJu2A//cangLN7tBQmXdH9dVqxeGRG/Ui0TX5PM e7owNoX4Z579zbkVUCJ2D5pvwWHTkG+2LUvXKpcv+93K5/Gl4U8jMCDcndtOzKuD PV65FpVNEimFc07DdIFhQgdHEfOuLKvNxj3qwAlRha4d9cR/HCWLh4yEdMi/zbR +IOyFntTZaf5jK0VzvihzoMIVGuoPmus+RdT2hmw4FivQu1xqAZ/28j3gJrV3PISK Icq4aloxGo3PhAR/LpQ27QAMypa9GiDCp/pkI7Isc+1w+uSV+vEulO5BSW9g/000 wXMCmZWh/1QoOh0ldhuEwlgVQo+BR2SfZeFagP4iFfHfaTYmUmCbUlgkI0jZv7XD 57QIG7LyYC1bDwud9Fg6lfmmKNhlfREA//AleZAFA9k+i8axRXwMAZ3XhCUPDAb9 A2KxldXfyGAXKqOcJctWKmqotgvFOVz4qQVM2Ay0YNsV0D2vyZONpaovW1qAVr5g zE8d0570+XqMZ+6ZnpeDCNRMI+xLH0WlA01+tgJgS6txhn/Y+7OTQHmSn35ddBnA ZYSy4REVX/2ZXsJ7LnoORj65MkwZiSCKilJtVMAk7AkdBaBAuGrHQdvT8MPgpfkl 0noBwidC3oS5aidyM0+HCrX/X1q9QZcTbgBWQ271Nq4Qg9nmakRA2eUIP7YFqNnU vf+cvrpb7+U= =XzN9 END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-284 | Access Control (Authorization) Issues |
CPE : Common Platform Enumeration
Alert History
Date | Informations |
---|---|
2016-03-03 21:29:08 |
|
2016-02-04 05:29:15 |
|
2016-02-04 05:24:43 |
|