CVE-2015-4306
HighSummary
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions and impersonate administrators of arbitrary tenant domains by discovering a session identifier and constructing a crafted URL.
Risk Assessment
The organization may be exposed to unauthorized access to administrative data and functions, potentially leading to serious security breaches and loss of customer trust.
Recommendation
It is recommended to update Cisco Prime Collaboration Assurance to the latest version to mitigate this vulnerability and implement additional security measures to monitor and restrict access to the system.
Other vulnerabilities in Cisco Prime Collaboration Assurance
See all- CVE-2017-6659High
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.
- CVE-2015-6389High
Cisco Prime Collaboration Assurance before version 11.0 has a hardcoded cmuser account that allows remote attackers to gain access by establishing an SSH session and leveraging knowledge of this account's password.
- CVE-2015-4304High
The web framework in Cisco Prime Collaboration Assurance before version 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, enabling the creation of administrative accounts or reading data from arbitrary tenant domains via a crafted URL.
Original NVD description (English source)
The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended login-session read restrictions, and impersonate administrators of arbitrary tenant domains, by discovering a session identifier and constructing a crafted URL, aka Bug IDs CSCus88343 and CSCus88334.