Lucene search

CiscoCVE-2016-6420

HistoryOct 05, 2016 - 10:59 a.m.

CVE-2016-6420

2016-10-0510:59:20

CWE-264

CWE-200

cisco

web.nvd.nist.gov

cisco

firesight

software

firepower

management center

cve-2016-6420

bug id cscur25467

nvd

security

authorization bypass

remote

authentication

http request

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

43.0%

JSON

Cisco FireSIGHT System Software 4.10.3 through 5.4.0 in Firepower Management Center allows remote authenticated users to bypass authorization checks and gain privileges via a crafted HTTP request, aka Bug ID CSCur25467.

Affected configurations

Nvd

Node

ciscofiresight_system_softwareMatch4.10.3

ciscofiresight_system_softwareMatch5.2.0

ciscofiresight_system_softwareMatch5.3.0

ciscofiresight_system_softwareMatch5.3.1

ciscofiresight_system_softwareMatch5.4.0

VendorProductVersionCPE
ciscofiresight_system_software4.10.3cpe:2.3:a:cisco:firesight_system_software:4.10.3:*:*:*:*:*:*:*
ciscofiresight_system_software5.2.0cpe:2.3:a:cisco:firesight_system_software:5.2.0:*:*:*:*:*:*:*
ciscofiresight_system_software5.3.0cpe:2.3:a:cisco:firesight_system_software:5.3.0:*:*:*:*:*:*:*
ciscofiresight_system_software5.3.1cpe:2.3:a:cisco:firesight_system_software:5.3.1:*:*:*:*:*:*:*
ciscofiresight_system_software5.4.0cpe:2.3:a:cisco:firesight_system_software:5.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	firesight_system_software	4.10.3	cpe:2.3:a:cisco:firesight_system_software:4.10.3:::::::*
cisco	firesight_system_software	5.2.0	cpe:2.3:a:cisco:firesight_system_software:5.2.0:::::::*
cisco	firesight_system_software	5.3.0	cpe:2.3:a:cisco:firesight_system_software:5.3.0:::::::*
cisco	firesight_system_software	5.3.1	cpe:2.3:a:cisco:firesight_system_software:5.3.1:::::::*
cisco	firesight_system_software	5.4.0	cpe:2.3:a:cisco:firesight_system_software:5.4.0:::::::*

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-fmc1

www.securityfocus.com/bid/93204

www.securitytracker.com/id/1036919

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

43.0%

JSON

Related for CVE-2016-6420