CVE-2014-2130

Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka Bug ID CSCuj83189.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130	Vendor Advisory
http://www.securitytracker.com/id/1031844
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130	Vendor Advisory
http://www.securitytracker.com/id/1031844

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:secure_access_control_system:-:*:*:*:*:*:*:*

History

21 Nov 2024, 02:05

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130 - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130 - Vendor Advisory
References	~~() http://www.securitytracker.com/id/1031844 -~~	() http://www.securitytracker.com/id/1031844 -

Information

Published : 2015-03-06 02:59

Updated : 2024-11-21 02:05

NVD link : CVE-2014-2130

Mitre link : CVE-2014-2130

CVE.ORG link : CVE-2014-2130

JSON object : View

Products Affected

cisco

secure_access_control_system

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-2130", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-03-06T02:59:00.080", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1031844", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2130", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1031844", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka Bug ID CSCuj83189."}, {"lang": "es", "value": "Cisco Secure Access Control Server (ACS) proporciona una interfaz web de la administraci\u00f3n no intencionada basada en Apache Tomcat, lo que permite a usuarios remotos autenticados modificar ficheros de aplicaciones y ficheros de configuraciones, y como consecuencia ejecutar c\u00f3digo arbitrario, mediante el aprovechamiento de privilegios de la administraci\u00f3n, tambi\u00e9n conocido como Bug ID CSCuj83189."}], "lastModified": "2024-11-21T02:05:42.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_access_control_system:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "716A2EC7-4A03-4BB9-B787-6DD285E25056"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}