CVE-2016-1457

{"id": "CVE-2016-1457", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2016-08-18T19:59:01.410", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-fmc", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/92509", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1036642", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-fmc", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/92509", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1036642", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 allows remote authenticated users to execute arbitrary commands as root via crafted HTTP requests, aka Bug ID CSCur25513."}, {"lang": "es", "value": "La GUI basada en web en Cisco Firepower Management Center 4.x y 5.x en versiones anteriores a 5.3.1.2 y 5.4.x en versiones anteriores a 5.4.0.1 y Cisco Adaptive Security Appliance (ASA) Software en dispositivos 5500-X con FirePOWER Services 4.x y 5.x en versiones anteriores a 5.3.1.2 y 5.4.x en versiones anteriores a 5.4.0.1 permite a usuarios remotos autenticados ejecutar comandos arbitrarios como root a trav\u00e9s de peticiones HTTP manipuladas, tambi\u00e9n conocido como Bug ID CSCur25513."}], "lastModified": "2024-11-21T02:46:28.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:firepower_management_center:4.10.3.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40129F73-08A0-4943-982C-5B74158D07E4"}, {"criteria": "cpe:2.3:a:cisco:firepower_management_center:5.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0163047-0645-4096-BD3D-ED04F7A390AE"}, {"criteria": "cpe:2.3:a:cisco:firepower_management_center:5.3.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "682B4681-A905-47EB-A430-2B77CBABC971"}, {"criteria": "cpe:2.3:a:cisco:firepower_management_center:5.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5320FAC0-17A9-4D76-BAB7-1F01AB5E6839"}, {"criteria": "cpe:2.3:a:cisco:firepower_management_center:5.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37F94CE2-06F1-4243-867C-E715704017B3"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}