CVE-2012-3063
published 2012-06-20CVE-2012-3063: Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address…
PriorityP429high7.1CVSS 2.0
AVNACHAuSCCICAC
EPSS
1.02%
59.4th percentile
Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances, and read or modify configuration settings, via a login attempt to a context, aka Bug ID CSCts30631, a different vulnerability than CVE-2012-3058.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | application_control_engine_administrator_ip_address_overlap | — | — |
| cisco | application_control_engine_software | <= a4\(2.0\) | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
| cisco | application_control_engine_software | — | — |
CVSS provenance
nvdv2.07.1HIGHAV:N/AC:H/Au:S/C:C/I:C/A:C
vendor_cisco7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Application Control Engine Administrator IP Address Overlap Vulnerability
vendor_cisco·2012-06-20·CVSS 7.1
CVE-2012-3063 [HIGH] Cisco Application Control Engine Administrator IP Address Overlap Vulnerability
Cisco Application Control Engine Administrator IP Address Overlap Vulnerability
A vulnerability exists in Cisco Application Control Engine (ACE) software. Administrative users may be logged into an unintended context (virtual instance) on the ACE when running in multicontext mode.
Cisco has released software updates that address this vulnerability. A workaround is available for this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ace
Cisco
Cisco Application Control Engine Administrator IP Address Overlap Vulnerability
vendor_cisco
CVE-2012-3063 Cisco Application Control Engine Administrator IP Address Overlap Vulnerability
CVE-2012-3063: Cisco Application Control Engine Administrator IP Address Overlap Vulnerability
A vulnerability exists in Cisco Application Control Engine (ACE) software. Administrative users may be logged into an unintended context (virtual instance) on the ACE when running in multicontext mode. Cisco has released software updates that address this vulnerability. A workaround is available for this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ace
Bug IDs: CSCts30631, CSCts30631
GHSA
GHSA-7gv3-h552-264c: Cisco Application Control Engine (ACE) before A4(2
ghsa_unreviewed·2022-05-17·CVSS 7.8
CVE-2012-3063 [HIGH] CWE-362 GHSA-7gv3-h552-264c: Cisco Application Control Engine (ACE) before A4(2
Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances, and read or modify configuration settings, via a login attempt to a context, aka Bug ID CSCts30631, a different vulnerability than CVE-2012-3058.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2012-06-20
Published