CVE-2015-4304
HighSummary
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, enabling the creation of administrative accounts or reading data from arbitrary tenant domains via a crafted URL.
Risk Assessment
The organization may be exposed to unauthorized data access and the ability to create administrative accounts, potentially leading to serious security breaches.
Recommendation
It is recommended to update Cisco Prime Collaboration Assurance to the latest version to mitigate this vulnerability and implement additional security measures to monitor user access.
Other vulnerabilities in Cisco Prime Collaboration Assurance
See all- CVE-2017-6659High
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.
- CVE-2015-6389High
Cisco Prime Collaboration Assurance before version 11.0 has a hardcoded cmuser account that allows remote attackers to gain access by establishing an SSH session and leveraging knowledge of this account's password.
- CVE-2015-4306High
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions and impersonate administrators of arbitrary tenant domains by discovering a session identifier and constructing a crafted URL.
Original NVD description (English source)
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652.