CVE-2015-6854

Critical

Published: 24/03/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Versions of CA Single Sign-On (SSO) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 have a vulnerability that allows remote attackers to cause a daemon crash or obtain sensitive information via a crafted request.

Risk Assessment

Organizations may be exposed to attacks that lead to system crashes or leakage of sensitive data, which can have serious security implications.

Recommendation

It is recommended to upgrade to the latest version of CA Single Sign-On to mitigate this vulnerability and to monitor systems for suspicious requests.

Original NVD description (English source)

The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.