CVE-2015-6404
published 2015-12-15CVE-2015-6404: Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information…
PriorityP416medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
0.95%
57.3th percentile
Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | hosted_collaboration_mediation_fulfillment_soap | — | — |
| cisco | hosted_collaboration_solution | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability
vendor_cisco·2015-12-10·CVSS 4.0
CVE-2015-6404 [MEDIUM] CWE-200 Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability
Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability
A vulnerability in the Simple Object Access Protocol (SOAP) application programming interface (API) of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an authenticated, remote attacker to obtain sensitive information that should be restricted. The attacker must authenticate as the admin user.
The vulnerability is due to lack of role-based access control (RBAC) in the application. An attacker could exploit this vulnerability by authenticating as the admin user and using the SOAP API to request restricted and sensitive information. An exploit could allow the attacker to obtain a list of customer credentials and other sensitive information.
Cisco has not rel
Cisco
Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability
vendor_cisco
CVE-2015-6404 Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability
CVE-2015-6404: Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability
A vulnerability in the Simple Object Access Protocol (SOAP) application programming interface (API) of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an authenticated, remote attacker to obtain sensitive information that should be restricted. The attacker must authenticate as the admin user. The vulnerability is due to lack of role-based access control (RBAC) in the application. An attacker could exploit this vulnerability by authenticating as the admin user and using the SOAP API to request restricted and sensitive information. An exploit could allow the attacker to obtain a list of customer credentials and other sensitive information. Cisco
GHSA
GHSA-jx4f-2jgh-g5h9: Cisco Hosted Collaboration Mediation Fulfillment 10
ghsa_unreviewed·2022-05-17
CVE-2015-6404 [MEDIUM] CWE-200 GHSA-jx4f-2jgh-g5h9: Cisco Hosted Collaboration Mediation Fulfillment 10
Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2015-12-15
Published