CVE-2015-0757

The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=39042	Vendor Advisory
http://www.securityfocus.com/bid/74864
http://www.securitytracker.com/id/1032420	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:identity_services_engine_software:1.2\(1.901\):::::::*
	cpe:2.3:a:cisco:identity_services_engine_software:1.3\(0.722\):::::::*

History

No history.

Information

Published : 2015-05-29 15:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-0757

Mitre link : CVE-2015-0757

CVE.ORG link : CVE-2015-0757

JSON object : View

Products Affected

cisco

identity_services_engine_software

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2015-0757", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-05-29T15:59:11.170", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39042", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/74864", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032420", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140."}, {"lang": "es", "value": "El Framework web en Cisco Identity Services Engine (ISE) 1.2(1.901) y 1.3(0.722) no implementa correctamente los manejadores de sesiones, lo que permite a atacantes remotos obtener informaci\u00f3n sensible mediante la lectura de p\u00e1ginas web, tal y como fue demostrado por informes MnT, tambi\u00e9n conocido como Bug ID CSCuq23140."}], "lastModified": "2017-03-24T01:59:00.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.2\\(1.901\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B634CA68-6F80-4D69-9A00-32E62E15D294"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.3\\(0.722\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75C5C1DD-658E-4376-9E05-997297E49C4C"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}