CVE-2015-4306

2015-09-2001:59:03

CWE-264

cisco

web.nvd.nist.gov

cisco

prime collaboration assurance

cve-2015-4306

web framework

security vulnerability

session identifier

impersonation

bug ids

nvd

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

AI Score

6.4

Confidence

Low

EPSS

0.002

Percentile

52.4%

JSON

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.

Affected configurations

Nvd

Node

ciscoprime_collaboration_assuranceMatch9.0.0

ciscoprime_collaboration_assuranceMatch9.5.0

ciscoprime_collaboration_assuranceMatch10.0.0

ciscoprime_collaboration_assuranceMatch10.5.0

ciscoprime_collaboration_assuranceMatch10.5.1

ciscoprime_collaboration_assuranceMatch10.6.0

VendorProductVersionCPE
ciscoprime_collaboration_assurance9.0.0cpe:2.3:a:cisco:prime_collaboration_assurance:9.0.0:*:*:*:*:*:*:*
ciscoprime_collaboration_assurance9.5.0cpe:2.3:a:cisco:prime_collaboration_assurance:9.5.0:*:*:*:*:*:*:*
ciscoprime_collaboration_assurance10.0.0cpe:2.3:a:cisco:prime_collaboration_assurance:10.0.0:*:*:*:*:*:*:*
ciscoprime_collaboration_assurance10.5.0cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.0:*:*:*:*:*:*:*
ciscoprime_collaboration_assurance10.5.1cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.1:*:*:*:*:*:*:*
ciscoprime_collaboration_assurance10.6.0cpe:2.3:a:cisco:prime_collaboration_assurance:10.6.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	prime_collaboration_assurance	9.0.0	cpe:2.3:a:cisco:prime_collaboration_assurance:9.0.0:::::::*
cisco	prime_collaboration_assurance	9.5.0	cpe:2.3:a:cisco:prime_collaboration_assurance:9.5.0:::::::*
cisco	prime_collaboration_assurance	10.0.0	cpe:2.3:a:cisco:prime_collaboration_assurance:10.0.0:::::::*
cisco	prime_collaboration_assurance	10.5.0	cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.0:::::::*
cisco	prime_collaboration_assurance	10.5.1	cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.1:::::::*
cisco	prime_collaboration_assurance	10.6.0	cpe:2.3:a:cisco:prime_collaboration_assurance:10.6.0:::::::*