CVE-2016-1360

Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw85390.

CVSS v3 7.1 HIGH
CVSS v2.0 3.0 LOW

7.1^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

3.0^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:S/C:P/I:P/A:N

Exploitability : 2.7 / Impact : 4.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160310-prime-lms	Vendor Advisory
http://www.securitytracker.com/id/1035313

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:prime_lan_management_solution:4.1_base:::::::*
	cpe:2.3:a:cisco:prime_lan_management_solution:4.2.1:::::::*
	cpe:2.3:a:cisco:prime_lan_management_solution:4.2.2:::::::*
	cpe:2.3:a:cisco:prime_lan_management_solution:4.2.3:::::::*
	cpe:2.3:a:cisco:prime_lan_management_solution:4.2.4:::::::*
	cpe:2.3:a:cisco:prime_lan_management_solution:4.2.5:::::::*
	cpe:2.3:a:cisco:prime_lan_management_solution:4.2_base:::::::*

History

No history.

Information

Published : 2016-03-12 02:59

Updated : 2024-02-04 18:53

NVD link : CVE-2016-1360

Mitre link : CVE-2016-1360

CVE.ORG link : CVE-2016-1360

JSON object : View

Products Affected

cisco

prime_lan_management_solution

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2016-1360", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.0, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 2.7, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "published": "2016-03-12T02:59:03.910", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160310-prime-lms", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1035313", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw85390."}, {"lang": "es", "value": "Cisco Prime LAN Management Solution (LMS) hasta la versi\u00f3n 4.2.5 utiliza la misma clave de cifrado de base de datos a trav\u00e9s de instalaciones de clientes diferentes, lo que permite a usuarios locales obtener datos en texto plano aprovechando la conectividad de la consola, tambi\u00e9n conocida como Bug ID CSCuw85390."}], "lastModified": "2016-12-03T03:20:43.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:prime_lan_management_solution:4.1_base:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C5E36F5-4AA3-4771-ADDC-B266402790C7"}, {"criteria": "cpe:2.3:a:cisco:prime_lan_management_solution:4.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DD8078E-C3EC-4366-B645-2FF8DCF6DA53"}, {"criteria": "cpe:2.3:a:cisco:prime_lan_management_solution:4.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E329DAC-C618-4DB0-88B7-A2867EA083AC"}, {"criteria": "cpe:2.3:a:cisco:prime_lan_management_solution:4.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81AA3169-7E6E-466B-B840-1E0E16AAD718"}, {"criteria": "cpe:2.3:a:cisco:prime_lan_management_solution:4.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "478E7F80-FAD8-4C28-A53C-76F4E389C07D"}, {"criteria": "cpe:2.3:a:cisco:prime_lan_management_solution:4.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14D3A897-D197-41CA-B825-E27EDA050595"}, {"criteria": "cpe:2.3:a:cisco:prime_lan_management_solution:4.2_base:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "534DDB94-8474-4066-9795-627A083B252A"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}