CVE-2015-4305
published 2015-09-20CVE-2015-4305: The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read…
PriorityP425medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
1.94%
77.9th percentile
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | prime_collaboration_assurance | — | — |
| cisco | prime_collaboration_assurance | — | — |
| cisco | prime_collaboration_assurance | — | — |
| cisco | prime_collaboration_assurance | — | — |
| cisco | prime_collaboration_assurance | — | — |
| cisco | prime_collaboration_assurance | — | — |
| cisco | prime_collaboration_assurance | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco9.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Prime Collaboration Assurance Information Disclosure Vulnerability
vendor_cisco·2015-09-16·CVSS 4.0
CVE-2015-4305 [MEDIUM] CWE-264 Cisco Prime Collaboration Assurance Information Disclosure Vulnerability
Cisco Prime Collaboration Assurance Information Disclosure Vulnerability
A vulnerability in the web framework of Cisco Prime Collaboration
Assurance could allow an authenticated, remote attacker to access
information about any device imported into the system database.
The
vulnerability is due to improper implementation of authorization and
access controls. An attacker could exploit this vulnerability by sending
crafted URLs to the system. The attacker would need to be logged in to
the system to exploit this vulnerability.
An exploit could
allow the attacker to access information about devices imported into the
system database, including devices for other customers or domains.
The information that an attacker could retrieve includes SNMP
community strings and devices' administrative cred
Cisco
Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
vendor_cisco·2015-09-16·CVSS 9.0
CVE-2015-4304 [CRITICAL] CWE-264 Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
Cisco Prime Collaboration Assurance Software contains the following vulnerabilities:
Cisco Prime Collaboration Assurance Web Framework Access Controls Bypass Vulnerability
Cisco Prime Collaboration Assurance Information Disclosure Vulnerability
Cisco Prime Collaboration Assurance Session ID Privilege Escalation Vulnerability
Successful exploitation of the Cisco Prime Collaboration Assurance Web Framework Access Controls Bypass Vulnerability and Cisco Prime Collaboration Assurance Session ID Privilege Escalation Vulnerability could allow an authenticated attacker to perform tasks with the privileges of an administrator for any domain or customer managed by the affected system.
Successful exploitation of the Cisco Prime Col
Cisco
Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
vendor_cisco
CVE-2015-4305 Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
CVE-2015-4305: Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
Cisco Prime Collaboration Assurance Software contains the following vulnerabilities: Cisco Prime Collaboration Assurance Web Framework Access Controls Bypass Vulnerability Cisco Prime Collaboration Assurance Information Disclosure Vulnerability Cisco Prime Collaboration Assurance Session ID Privilege Escalation Vulnerability Successful exploitation of the Cisco Prime Collaboration Assurance Web Framework Access Controls Bypass Vulnerability and Cisco Prime Collaboration Assurance Session ID Privilege Escalation Vulnerability could allow an authenticated attacker to perform tasks with the privileges of an administrator for any domain or customer managed by the affected system. Successful exploitation of the Cisco
GHSA
GHSA-gv5m-498p-x725: The web framework in Cisco Prime Collaboration Assurance before 10
ghsa_unreviewed·2022-05-17
CVE-2015-4305 [MEDIUM] GHSA-gv5m-498p-x725: The web framework in Cisco Prime Collaboration Assurance before 10
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, aka Bug ID CSCus62656.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pcahttp://tools.cisco.com/security/center/viewAlert.x?alertId=40520http://www.securitytracker.com/id/1033581http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150916-pcahttp://tools.cisco.com/security/center/viewAlert.x?alertId=40520http://www.securitytracker.com/id/1033581
2015-09-20
Published