CVE-2015-0768

The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=39192	Vendor Advisory
http://www.securitytracker.com/id/1032541	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:prime_network_control_system:2.1\(0.0.85\):::::::*
	cpe:2.3:a:cisco:prime_network_control_system:2.2\(0.0.58\):::::::*
	cpe:2.3:a:cisco:prime_network_control_system:2.2\(0.0.69\):::::::*

History

No history.

Information

Published : 2015-06-12 14:59

Updated : 2024-02-28 15:21

NVD link : CVE-2015-0768

Mitre link : CVE-2015-0768

CVE.ORG link : CVE-2015-0768

JSON object : View

Products Affected

cisco

prime_network_control_system

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-0768", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-06-12T14:59:00.067", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39192", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032541", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371."}, {"lang": "es", "value": "El componente Device Work Center (DWC) en Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), y 2.2(0.0.69) no implementa correctamente los roles AAA, lo que permite a usuarios remotos autenticados evadir las restricciones de acceso y ejecutar comandos a trav\u00e9s de una sesi\u00f3n de inicio de sesi\u00f3n, tambi\u00e9n conocido como Bug ID CSCur27371."}], "lastModified": "2017-01-04T16:03:14.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:prime_network_control_system:2.1\\(0.0.85\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "351DCD00-92F5-4012-A845-2EAF3EA112CB"}, {"criteria": "cpe:2.3:a:cisco:prime_network_control_system:2.2\\(0.0.58\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E79C1A40-8AA3-482C-9B5E-072A7A25EF52"}, {"criteria": "cpe:2.3:a:cisco:prime_network_control_system:2.2\\(0.0.69\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "828A121A-0D18-45A5-8E84-CD01CCA7C555"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}