CVE-2015-0653

The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs	Vendor Advisory
http://www.securitytracker.com/id/1031910	Third Party Advisory VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs	Vendor Advisory
http://www.securitytracker.com/id/1031910	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:expressway_software::::::::
	cpe:2.3:a:cisco:expressway_software::::::::
	cpe:2.3:a:cisco:expressway_software::::::::
	cpe:2.3:a:cisco:telepresence_conductor::::::::
	cpe:2.3:a:cisco:telepresence_conductor::::::::
	cpe:2.3:a:cisco:telepresence_video_communication_server_software::::::::
	cpe:2.3:a:cisco:telepresence_video_communication_server_software::::::::
	cpe:2.3:a:cisco:telepresence_video_communication_server_software::::::::

History

21 Nov 2024, 02:23

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs - Vendor Advisory
References	~~() http://www.securitytracker.com/id/1031910 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1031910 - Third Party Advisory, VDB Entry

Information

Published : 2015-03-13 01:59

Updated : 2024-11-21 02:23

NVD link : CVE-2015-0653

Mitre link : CVE-2015-0653

CVE.ORG link : CVE-2015-0653

JSON object : View

Products Affected

cisco

expressway_software
telepresence_conductor
telepresence_video_communication_server_software

CWE

CWE-287

Improper Authentication

{"id": "CVE-2015-0653", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-03-13T01:59:32.427", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1031910", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1031910", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556."}, {"lang": "es", "value": "La interfaz de gesti\u00f3n en Cisco TelePresence Video Communication Server (VCS) y Cisco Expressway anterior a X7.2.4, X8 anterior a X8.1.2, y X8.2 anterior a X8.2.2 y Cisco TelePresence Conductor anterior a X2.3.1 y XC2.4 anterior a XC2.4.1 permite a atacantes remotos evadir la autenticaci\u00f3n a trav\u00e9s de par\u00e1metros de inicio de sesi\u00f3n manipulados, tambi\u00e9n conocido como Bug IDs CSCur02680 y CSCur05556."}], "lastModified": "2024-11-21T02:23:28.730", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:expressway_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77EF82E8-2E13-42AF-B593-8E37D048429C", "versionEndExcluding": "x7.2.4", "versionStartIncluding": "x7.2"}, {"criteria": "cpe:2.3:a:cisco:expressway_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B629603-C53F-4766-8A41-C71241F68803", "versionEndExcluding": "x8.1.2", "versionStartIncluding": "x8.1"}, {"criteria": "cpe:2.3:a:cisco:expressway_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A887E79B-F041-469F-9477-A5E4546882EC", "versionEndExcluding": "x8.2.2", "versionStartIncluding": "x8.2"}, {"criteria": "cpe:2.3:a:cisco:telepresence_conductor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10E2CE09-8C7D-4EA9-871A-5FC3F0D6563C", "versionEndExcluding": "x2.3.1", "versionStartIncluding": "x2.3"}, {"criteria": "cpe:2.3:a:cisco:telepresence_conductor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F17C9CD1-9993-46D8-87D1-9D785B8C188F", "versionEndExcluding": "xc2.4.1", "versionStartIncluding": "xc2.4"}, {"criteria": "cpe:2.3:a:cisco:telepresence_video_communication_server_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D5278EA-73AD-4D5C-AEDA-6BA8C59A45EE", "versionEndExcluding": "x7.2.4", "versionStartIncluding": "x7.2"}, {"criteria": "cpe:2.3:a:cisco:telepresence_video_communication_server_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19CFA1F5-4BD0-4304-9012-F1B6A5D6D0C0", "versionEndExcluding": "x8.1.2", "versionStartIncluding": "x8.1"}, {"criteria": "cpe:2.3:a:cisco:telepresence_video_communication_server_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2068420-4E30-43DA-9ECD-F3568D35AE51", "versionEndExcluding": "x8.2.2", "versionStartIncluding": "x8.2"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}