CVE-2015-4327

The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=40518	Vendor Advisory
http://www.securityfocus.com/bid/76408	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1033332	Third Party Advisory VDB Entry
http://tools.cisco.com/security/center/viewAlert.x?alertId=40518	Vendor Advisory
http://www.securityfocus.com/bid/76408	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1033332	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.5.2:*:*:*:expressway:*:*:*

History

21 Nov 2024, 02:30

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=40518 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=40518 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/76408 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/76408 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1033332 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1033332 - Third Party Advisory, VDB Entry

Information

Published : 2015-08-20 00:59

Updated : 2024-11-21 02:30

NVD link : CVE-2015-4327

Mitre link : CVE-2015-4327

CVE.ORG link : CVE-2015-4327

JSON object : View

Products Affected

cisco

telepresence_video_communication_server_software

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2015-4327", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-20T00:59:04.967", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=40518", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/76408", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1033332", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=40518", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/76408", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1033332", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The CLI in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to obtain root privileges by writing script arguments to an unspecified file, aka Bug ID CSCuv12542."}, {"lang": "es", "value": "Vulnerabilidad en la CLI en TelePresence Video Communication Server (VCS) Expressway X8.5.2, permite a usuarios locales obtener privilegios de root mediante la escritura de argumentos en secuencias de comandos a un archivo no especificado, tambi\u00e9n conocido como Bug ID CSCuv12542."}], "lastModified": "2024-11-21T02:30:50.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.5.2:*:*:*:expressway:*:*:*", "vulnerable": true, "matchCriteriaId": "E549E37F-3D1A-490B-8BEE-482D082486EA"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}