Executive Summary

Summary
Title Cisco ASA-CX and Cisco Prime Security Manager Privilege Escalation Vulnerability
Informations
Name cisco-sa-20160203-prsm First vendor Publication 2016-02-03
Vendor Cisco Last vendor Modification 2016-02-03
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Cvss Base Score 8.5 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 6.8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability in the role-based access control of Cisco ASA-CX and Cisco Prime Security Manager (PRSM) could allow an authenticated, remote attacker to change the password of any user on the system.

The vulnerability exists because the password change request is not fully qualified. An authenticated attacker with a user role other than Administrator could exploit this vulnerability by sending a specially crafted HTTP request to the Cisco PRSM. An exploit could allow the attacker to change the password of any user on the system, including users with the Administrator role.

Cisco has released software updates that address this vulnerability.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-prsm

BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVrChQq89gD3EAJB5AQJu2A//cangLN7tBQmXdH9dVqxeGRG/Ui0TX5PM e7owNoX4Z579zbkVUCJ2D5pvwWHTkG+2LUvXKpcv+93K5/Gl4U8jMCDcndtOzKuD PV65FpVNEimFc07DdIFhQgdHEfOuLKvNxj3qwAlRha4d9cR/HCWLh4yEdMi/zbR +IOyFntTZaf5jK0VzvihzoMIVGuoPmus+RdT2hmw4FivQu1xqAZ/28j3gJrV3PISK Icq4aloxGo3PhAR/LpQ27QAMypa9GiDCp/pkI7Isc+1w+uSV+vEulO5BSW9g/000 wXMCmZWh/1QoOh0ldhuEwlgVQo+BR2SfZeFagP4iFfHfaTYmUmCbUlgkI0jZv7XD 57QIG7LyYC1bDwud9Fg6lfmmKNhlfREA//AleZAFA9k+i8axRXwMAZ3XhCUPDAb9 A2KxldXfyGAXKqOcJctWKmqotgvFOVz4qQVM2Ay0YNsV0D2vyZONpaovW1qAVr5g zE8d0570+XqMZ+6ZnpeDCNRMI+xLH0WlA01+tgJgS6txhn/Y+7OTQHmSn35ddBnA ZYSy4REVX/2ZXsJ7LnoORj65MkwZiSCKilJtVMAk7AkdBaBAuGrHQdvT8MPgpfkl 0noBwidC3oS5aidyM0+HCrX/X1q9QZcTbgBWQ271Nq4Qg9nmakRA2eUIP7YFqNnU vf+cvrpb7+U= =XzN9 END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-284 Access Control (Authorization) Issues

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 12
Os 14

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2016-03-03 21:29:08
  • Multiple Updates
2016-02-04 05:29:15
  • Multiple Updates
2016-02-04 05:24:43
  • First insertion