CVE-2016-1406
HighSummary
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, consequently gaining privileges.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data and privilege escalation by remote users, potentially leading to serious security breaches.
Recommendation
It is recommended to update Cisco Prime Infrastructure to version 3.1 or later and Cisco Evolved Programmable Network Manager to version 1.2.4 or later to mitigate this vulnerability.
Other vulnerabilities in Cisco Prime Infrastructure, Cisco Evolved Programmable Network Manager
See all- CVE-2016-1290High
The web API in Cisco Prime Infrastructure versions 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter.
- CVE-2016-1291Critical
Cisco Prime Infrastructure versions 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) version 1.2 are vulnerable to remote code execution by attackers who can exploit crafted deserialized data in an HTTP POST request.
Original NVD description (English source)
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.