CVE-2016-1290
HighSummary
The web API in Cisco Prime Infrastructure versions 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update to the latest software version and implement additional security measures to mitigate the risk of unauthorized access.
Other vulnerabilities in Cisco Prime Infrastructure, Cisco Evolved Programmable Network Manager
See all- CVE-2016-1406High
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, consequently gaining privileges.
- CVE-2016-1291Critical
Cisco Prime Infrastructure versions 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) version 1.2 are vulnerable to remote code execution by attackers who can exploit crafted deserialized data in an HTTP POST request.
Original NVD description (English source)
The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.