Lucene search

[email protected]CVE-2016-1290

HistoryApr 06, 2016 - 11:59 p.m.

CVE-2016-1290

2016-04-0623:59:00

CWE-264

[email protected]

web.nvd.nist.gov

cisco

prime infrastructure

epnm

cve-2016-1290

rbac

security vulnerability

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.8 High

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

46.2%

JSON

The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.

CPENameOperatorVersion
cisco:prime_infrastructurecisco prime infrastructureeq1.4.2
cisco:prime_infrastructurecisco prime infrastructureeq2.2
cisco:prime_infrastructurecisco prime infrastructureeq1.2.1
cisco:prime_infrastructurecisco prime infrastructureeq2.1.0
sun:opensolarissun opensolariseqsnv_124
cisco:evolved_programmable_network_managercisco evolved programmable network managereq1.2.0
cisco:prime_infrastructurecisco prime infrastructureeq1.3.0.20
cisco:prime_infrastructurecisco prime infrastructureeq1.2.0.103
cisco:prime_infrastructurecisco prime infrastructureeq1.4.0.45
cisco:prime_infrastructurecisco prime infrastructureeq1.4.1

CPE	Name	Operator	Version
cisco:prime_infrastructure	cisco prime infrastructure	eq	1.4.2
cisco:prime_infrastructure	cisco prime infrastructure	eq	2.2
cisco:prime_infrastructure	cisco prime infrastructure	eq	1.2.1
cisco:prime_infrastructure	cisco prime infrastructure	eq	2.1.0
sun:opensolaris	sun opensolaris	eq	snv_124
cisco:evolved_programmable_network_manager	cisco evolved programmable network manager	eq	1.2.0
cisco:prime_infrastructure	cisco prime infrastructure	eq	1.3.0.20
cisco:prime_infrastructure	cisco prime infrastructure	eq	1.2.0.103
cisco:prime_infrastructure	cisco prime infrastructure	eq	1.4.0.45
cisco:prime_infrastructure	cisco prime infrastructure	eq	1.4.1

Rows per page:

1-10 of 141

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth

www.securitytracker.com/id/1035498

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.8 High

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

46.2%

JSON

Related for CVE-2016-1290

prion1 cisco1 cvelist1 openvas1