Detections
Analytics
Cisco Prime Collaboration Assurance Multiple Vulnerabilities (cisco-sa-20100217-csa)
high Nessus Plugin ID 86152
Language:
Synopsis
The remote network management device is affected by multiple vulnerabilities.Description
According to its self-reported version number, the remote Cisco Prime Collaboration Assurance device is prior to 10.5.1.53684 or is in the 10.6 release branch. It is, therefore, affected by the following vulnerabilities :- A security bypass vulnerability exists in the web framework due to improper implementation of authorization and access controls. An authenticated, remote attacker can exploit this, via a crafted URL request, to access higher-privileged functions that are normally restricted to administrative users only.
(CVE-2015-4304)
- An information disclosure vulnerability exists in the web framework due to improper implementation of authorization and access controls. An authenticated, remote attacker can exploit this, via a crafted URL request, to access information about devices imported into the system database, including SNMP community strings and administrative credentials. (CVE-2015-4305)
- An information disclosure vulnerability exists in the web framework due to improper implementation of authorization and access controls. An authenticated, remote attacker can exploit this, via a crafted URL request, to access information about users who are logged in to the system, including users' session identifiers. The identifiers can be used by an attacker to impersonate any user, including administrative users.
(CVE-2015-4306)
Solution
Upgrade to Cisco Prime Collaboration Assurance version 10.5.1.53684 or 11.0. Note that there is no fix for version 10.6.See Also
Plugin Details
Severity: High
ID: 86152
File Name: cisco_prime_ca_sa-20150916.nasl
Version: 1.8
Type: remote
Family: CISCO
Published: 9/25/2015
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:cisco:prime_collaboration_assurance
Required KB Items: Host/Cisco/PrimeCollaborationAssurance/version
Exploit Ease: No known exploits are available
Patch Publication Date: 9/16/2015
Vulnerability Publication Date: 9/16/2015
Reference Information
CVE: CVE-2015-4304, CVE-2015-4305, CVE-2015-4306
CISCO-SA: cisco-sa-20150916-pca
CISCO-BUG-ID: CSCus62652, CSCus62656, CSCus62671, CSCus88334, CSCus88343