CVE-2015-4225

Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=39529	Vendor Advisory
http://www.securityfocus.com/bid/75433	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032735	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:cisco:nx-os:1.0\(1.110a\):::::::*
	cpe:2.3:o:cisco:nx-os:1.0\(1e\):::::::*

OR	cpe:2.3:h:cisco:nexus_93120tx:-:::::::*
	cpe:2.3:h:cisco:nexus_93128tx:-:::::::*
	cpe:2.3:h:cisco:nexus_9332pq:-:::::::*
	cpe:2.3:h:cisco:nexus_9336pq_aci_spine:-:::::::*
	cpe:2.3:h:cisco:nexus_9372px:-:::::::*
	cpe:2.3:h:cisco:nexus_9372tx:-:::::::*
	cpe:2.3:h:cisco:nexus_9396px:-:::::::*
	cpe:2.3:h:cisco:nexus_9396tx:-:::::::*
	cpe:2.3:h:cisco:nexus_9504:-:::::::*
	cpe:2.3:h:cisco:nexus_9508:-:::::::*
	cpe:2.3:h:cisco:nexus_9516:-:::::::*

History

No history.

Information

Published : 2015-06-27 10:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-4225

Mitre link : CVE-2015-4225

CVE.ORG link : CVE-2015-4225

JSON object : View

Products Affected

cisco

nexus_9504
nexus_9332pq
nexus_9372tx
nexus_9336pq_aci_spine
nexus_9508
nexus_9516
nexus_9396px
nexus_93128tx
nx-os
nexus_9372px
nexus_9396tx
nexus_93120tx

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-4225", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-06-27T10:59:01.173", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39529", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/75433", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032735", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID CSCuq77485."}, {"lang": "es", "value": "Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) y 1.0(1e) en los dispositivos Nexus 9000 no implementa correctamente la puntuaci\u00f3n de salud RBAC, lo que permite a usuarios remotos autenticados obtener informaci\u00f3n sensible a trav\u00e9s de vectores no especificados, tambi\u00e9n conocido como Bug ID CSCuq77485."}], "lastModified": "2016-12-29T13:31:53.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:nx-os:1.0\\(1.110a\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADE956FC-1BEF-40E6-AD94-B61ABBAC22EF"}, {"criteria": "cpe:2.3:o:cisco:nx-os:1.0\\(1e\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60E0DFB9-D722-445D-B9CD-AA36B4CDC659"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "07DE6F63-2C7D-415B-8C34-01EC05C062F3"}, {"criteria": "cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F423E45D-A6DD-4305-9C6A-EAB26293E53A"}, {"criteria": "cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "113772B6-E9D2-4094-9468-3F4E1A87D07D"}, {"criteria": "cpe:2.3:h:cisco:nexus_9336pq_aci_spine:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "785FD17C-F32E-4042-9DDE-A89B3AAE0334"}, {"criteria": "cpe:2.3:h:cisco:nexus_9372px:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4364ADB9-8162-451D-806A-B98924E6B2CF"}, {"criteria": "cpe:2.3:h:cisco:nexus_9372tx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "49E0371B-FDE2-473C-AA59-47E1269D050F"}, {"criteria": "cpe:2.3:h:cisco:nexus_9396px:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1BC5293E-F2B4-46DC-85DA-167EA323FCFD"}, {"criteria": "cpe:2.3:h:cisco:nexus_9396tx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EA022E77-6557-4A33-9A3A-D028E2DB669A"}, {"criteria": "cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "768BE390-5ED5-48A7-9E80-C4DE8BA979B1"}, {"criteria": "cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DDC2F709-AFBE-48EA-A3A2-DA1134534FB6"}, {"criteria": "cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7E02DC82-0D26-436F-BA64-73C958932B0A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}