CVE-2016-1302
published 2016-02-07CVE-2016-1302: Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with…
PriorityP349high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
2.18%
81.6th percentile
Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with software before 11.0(3h) and 11.1 before 11.1(1j) allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka Bug ID CSCut12998.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | application_policy_infrastructure_controller | — | — |
| cisco | nx-os | — | — |
| samsung | x14j_firmware | — | — |
| sun | opensolaris | — | — |
| zyxel | gs1900-10hp_firmware | < 2.50\(aazi.0\)c0 | 2.50\(aazi.0\)c0 |
| zzinc | keymouse_firmware | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_cisco8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wjw2-7prx-p46x: Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1
ghsa_unreviewed·2022-05-17
CVE-2016-1302 [HIGH] CWE-284 GHSA-wjw2-7prx-p46x: Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1
Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with software before 11.0(3h) and 11.1 before 11.1(1j) allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka Bug ID CSCut12998.
Cisco
Cisco Application Policy Infrastructure Controller Access Control Vulnerability
vendor_cisco·2016-02-04·CVSS 8.5
CVE-2016-1302 [HIGH] CWE-264 Cisco Application Policy Infrastructure Controller Access Control Vulnerability
Cisco Application Policy Infrastructure Controller Access Control Vulnerability
A vulnerability in the role-based access control (RBAC) of the Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated remote user to make configuration changes outside of their configured access privileges.
The vulnerability is due to eligibility logic in the RBAC processing code. An authenticated user could exploit this vulnerability by sending specially crafted representational state transfer (REST) requests to the APIC. An exploit could allow the authenticated user to make configuration changes to the APIC beyond the configured privilege for their role.
Cisco has released software updates that address this vulnerability.
This advisory is available at the following link: ht
Cisco
Cisco Application Policy Infrastructure Controller Access Control Vulnerability
vendor_cisco
CVE-2016-1302 Cisco Application Policy Infrastructure Controller Access Control Vulnerability
CVE-2016-1302: Cisco Application Policy Infrastructure Controller Access Control Vulnerability
A vulnerability in the role-based access control (RBAC) of the Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated remote user to make configuration changes outside of their configured access privileges. The vulnerability is due to eligibility logic in the RBAC processing code. An authenticated user could exploit this vulnerability by sending specially crafted representational state transfer (REST) requests to the APIC. An exploit could allow the authenticated user to make configuration changes to the APIC beyond the configured privilege for their role. Cisco has released software updates that address this vulnerability. This advisory is available at the followi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2016-02-07
Published