Lucene search

[email protected]CVE-2016-6426

HistoryOct 05, 2016 - 9:59 p.m.

CVE-2016-6426

2016-10-0521:59:00

CWE-20

[email protected]

web.nvd.nist.gov

cisco

cuic

cve-2016-6426

security vulnerability

remote attack

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.003 Low

EPSS

Percentile

69.8%

JSON

The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs CSCuy75027 and CSCuy81653.

Affected configurations

NVD

Node

ciscounified_contact_center_expressMatch10.0\(1\)

ciscounified_contact_center_expressMatch10.5\(1\)

ciscounified_contact_center_expressMatch10.6\(1\)

ciscounified_contact_center_expressMatch11.0\(1\)

ciscounified_intelligence_centerMatch8.5.4

ciscounified_intelligence_centerMatch9.0\(2\)

ciscounified_intelligence_centerMatch9.1\(1\)

CPENameOperatorVersion
cisco:unified_contact_center_expresscisco unified contact center expresseq10.0\(1\)
cisco:unified_contact_center_expresscisco unified contact center expresseq10.5\(1\)
cisco:unified_contact_center_expresscisco unified contact center expresseq10.6\(1\)
cisco:unified_contact_center_expresscisco unified contact center expresseq11.0\(1\)
cisco:unified_intelligence_centercisco unified intelligence centereq8.5.4
cisco:unified_intelligence_centercisco unified intelligence centereq9.0\(2\)
cisco:unified_intelligence_centercisco unified intelligence centereq9.1\(1\)

CPE	Name	Operator	Version
cisco:unified_contact_center_express	cisco unified contact center express	eq	10.0\(1\)
cisco:unified_contact_center_express	cisco unified contact center express	eq	10.5\(1\)
cisco:unified_contact_center_express	cisco unified contact center express	eq	10.6\(1\)
cisco:unified_contact_center_express	cisco unified contact center express	eq	11.0\(1\)
cisco:unified_intelligence_center	cisco unified intelligence center	eq	8.5.4
cisco:unified_intelligence_center	cisco unified intelligence center	eq	9.0\(2\)
cisco:unified_intelligence_center	cisco unified intelligence center	eq	9.1\(1\)

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ucis2

www.securityfocus.com/bid/93420

www.securitytracker.com/id/1036952

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.003 Low

EPSS

Percentile

69.8%

JSON

Related for CVE-2016-6426

prion1 nessus1 nvd1 cisco1 cvelist1