Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveCiscoCVE-2015-6357
HistoryNov 18, 2015 - 11:59 a.m.

CVE-2015-6357

2015-11-1811:59:01
CWE-20
cisco
web.nvd.nist.gov
29
cisco
firesight
management center
mc
man-in-the-middle
attack
spoofing
bug id
cscuw06444
nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.1

Confidence

High

EPSS

0.003

Percentile

71.9%

JSON

The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide an invalid package, and consequently execute arbitrary code, via a crafted certificate, aka Bug ID CSCuw06444.

Affected configurations

Nvd
Node
ciscofiresight_system_softwareMatch5.2.0
OR
ciscofiresight_system_softwareMatch5.3.0
OR
ciscofiresight_system_softwareMatch5.3.1.1
OR
ciscofiresight_system_softwareMatch5.3.1.2
OR
ciscofiresight_system_softwareMatch5.3.1.5
OR
ciscofiresight_system_softwareMatch5.4.0
OR
ciscofiresight_system_softwareMatch5.4.0.1
VendorProductVersionCPE
ciscofiresight_system_software5.2.0cpe:2.3:a:cisco:firesight_system_software:5.2.0:*:*:*:*:*:*:*
ciscofiresight_system_software5.3.0cpe:2.3:a:cisco:firesight_system_software:5.3.0:*:*:*:*:*:*:*
ciscofiresight_system_software5.3.1.1cpe:2.3:a:cisco:firesight_system_software:5.3.1.1:*:*:*:*:*:*:*
ciscofiresight_system_software5.3.1.2cpe:2.3:a:cisco:firesight_system_software:5.3.1.2:*:*:*:*:*:*:*
ciscofiresight_system_software5.3.1.5cpe:2.3:a:cisco:firesight_system_software:5.3.1.5:*:*:*:*:*:*:*
ciscofiresight_system_software5.4.0cpe:2.3:a:cisco:firesight_system_software:5.4.0:*:*:*:*:*:*:*
ciscofiresight_system_software5.4.0.1cpe:2.3:a:cisco:firesight_system_software:5.4.0.1:*:*:*:*:*:*:*

Related

cvelist 1
openvas 1
cisco 1
nvd 1
prion 1
cvelist
cvelist
CVE-2015-6357
2015-11-18 11:00:00
openvas
openvas
Cisco FireSIGHT Management Center Certificate Validation Vulnerability
2015-11-16 00:00:00
cisco
cisco
Cisco FireSIGHT Management Center Certificate Validation Vulnerability
2015-11-16 10:00:00
nvd
nvd
CVE-2015-6357
2015-11-18 11:59:01
prion
prion
Design/Logic Flaw
2015-11-18 11:59:00

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.1

Confidence

High

EPSS

0.003

Percentile

71.9%

JSON
Related for CVE-2015-6357
cvelist1openvas1cisco1nvd1prion1