Lucene search

CiscoCVE-2015-4219

HistoryJun 24, 2015 - 10:59 a.m.

CVE-2015-4219

2015-06-2410:59:12

CWE-264

CWE-200

cisco

web.nvd.nist.gov

cisco

secure access control system

identity services engine

vulnerability

access control

brute-force

cscue00833

cscub40331

cve-2015-4219

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

47.3%

JSON

Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331.

Affected configurations

Nvd

Node

ciscoidentity_services_engine_softwareMatch1.0.4.573

ciscosecure_access_control_systemRange≤5.4.0.46.1

ciscosecure_access_control_systemMatch5.3.0.40.5

VendorProductVersionCPE
ciscoidentity_services_engine_software1.0.4.573cpe:2.3:a:cisco:identity_services_engine_software:1.0.4.573:*:*:*:*:*:*:*
ciscosecure_access_control_system*cpe:2.3:a:cisco:secure_access_control_system:*:*:*:*:*:*:*:*
ciscosecure_access_control_system5.3.0.40.5cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	identity_services_engine_software	1.0.4.573	cpe:2.3:a:cisco:identity_services_engine_software:1.0.4.573:::::::*
cisco	secure_access_control_system	*	cpe:2.3:a:cisco:secure_access_control_system::::::::
cisco	secure_access_control_system	5.3.0.40.5	cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.5:::::::*

References

tools.cisco.com/security/center/viewAlert.x?alertId=39501

www.securityfocus.com/bid/75379

www.securitytracker.com/id/1032713

www.securitytracker.com/id/1032714

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

47.3%

JSON

Related for CVE-2015-4219