CVE-2015-4306

2015-09-2001:59:00

CWE-264

[email protected]

web.nvd.nist.gov

cisco

prime collaboration assurance

cve-2015-4306

web framework

security vulnerability

session identifier

impersonation

bug ids

nvd

6.5 Medium

AI Score

Confidence

Low

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

52.2%

JSON

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.

CPENameOperatorVersion
cisco:prime_collaboration_assurancecisco prime collaboration assuranceeq10.5.1
cisco:prime_collaboration_assurancecisco prime collaboration assuranceeq10.0.0
cisco:prime_collaboration_assurancecisco prime collaboration assuranceeq9.0.0
cisco:prime_collaboration_assurancecisco prime collaboration assuranceeq10.6.0
cisco:prime_collaboration_assurancecisco prime collaboration assuranceeq9.5.0
cisco:prime_collaboration_assurancecisco prime collaboration assuranceeq10.5.0

CPE	Name	Operator	Version
cisco:prime_collaboration_assurance	cisco prime collaboration assurance	eq	10.5.1
cisco:prime_collaboration_assurance	cisco prime collaboration assurance	eq	10.0.0
cisco:prime_collaboration_assurance	cisco prime collaboration assurance	eq	9.0.0
cisco:prime_collaboration_assurance	cisco prime collaboration assurance	eq	10.6.0
cisco:prime_collaboration_assurance	cisco prime collaboration assurance	eq	9.5.0
cisco:prime_collaboration_assurance	cisco prime collaboration assurance	eq	10.5.0