Lucene search

[email protected]CVE-2015-4262

HistoryJul 24, 2015 - 2:59 p.m.

CVE-2015-4262

2015-07-2414:59:02

CWE-255

[email protected]

web.nvd.nist.gov

cisco

unified meetingplace

web conferencing

password change

remote attack

cve-2015-4262

nvd

6.8 Medium

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

52.5%

JSON

The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.5(5) MR3 and 8.6 before 8.6(2) does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839.

Affected configurations

NVD

Node

ciscounified_meetingplace_web_conferencingMatch6.0.417.0

ciscounified_meetingplace_web_conferencingMatch6.0_base

ciscounified_meetingplace_web_conferencingMatch7.0\(1\)

ciscounified_meetingplace_web_conferencingMatch7.0\(2\)

ciscounified_meetingplace_web_conferencingMatch7.0\(2\)_sr1

ciscounified_meetingplace_web_conferencingMatch7.0\(3\)

ciscounified_meetingplace_web_conferencingMatch7.1\(1\)

ciscounified_meetingplace_web_conferencingMatch7.1\(2\)

ciscounified_meetingplace_web_conferencingMatch8.0\(1\)

ciscounified_meetingplace_web_conferencingMatch8.0\(1\)_sr1

ciscounified_meetingplace_web_conferencingMatch8.0\(2\)

ciscounified_meetingplace_web_conferencingMatch8.5\(1\)

ciscounified_meetingplace_web_conferencingMatch8.5\(2\)

ciscounified_meetingplace_web_conferencingMatch8.5\(2\)_sr1

ciscounified_meetingplace_web_conferencingMatch8.5\(2\)_sr2

ciscounified_meetingplace_web_conferencingMatch8.5\(3\)

ciscounified_meetingplace_web_conferencingMatch8.5\(4\)

CPENameOperatorVersion
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq6.0.417.0
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq6.0_base
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq7.0\(1\)
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq7.0\(2\)
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq7.0\(2\)_sr1
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq7.0\(3\)
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq7.1\(1\)
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq7.1\(2\)
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq8.0\(1\)
cisco:unified_meetingplace_web_conferencingcisco unified meetingplace web conferencingeq8.0\(1\)_sr1

CPE	Name	Operator	Version
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	6.0.417.0
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	6.0_base
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	7.0\(1\)
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	7.0\(2\)
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	7.0\(2\)_sr1
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	7.0\(3\)
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	7.1\(1\)
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	7.1\(2\)
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	8.0\(1\)
cisco:unified_meetingplace_web_conferencing	cisco unified meetingplace web conferencing	eq	8.0\(1\)_sr1