CVE-2016-1402

{"id": "CVE-2016-1402", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2016-05-21T01:59:01.520", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160517-ise", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1035946", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a denial of service (authentication outage) via a crafted Password Authentication Protocol (PAP) authentication request, aka Bug ID CSCun25815."}, {"lang": "es", "value": "El componente de integraci\u00f3n Active Directory (AD) en Cisco Identity Service Engine (ISE) en versiones anteriores a 1.2.0.899 patch 7, cuando se habilita la autorizaci\u00f3n para miembros del grupo AD, permite a atacantes remotos provocar una denegaci\u00f3n del servicio (fallo de autenticaci\u00f3n) a trav\u00e9s de una solicitud de autenticaci\u00f3n Password Authentication Protocol (PAP) manipulada, tambi\u00e9n conocido como Bug ID CSCun25815."}], "lastModified": "2016-12-01T03:05:33.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:identity_services_engine:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9A8A64C2-2A16-4A96-822D-2EFC3D61D58D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.2.0.899:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "033CAAE3-9F6D-4077-80F8-C3FC4821DC31"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.2.0.899:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DE94874-135D-4B99-BCB0-320003FFD42B"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.2.0.899:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6A1503D-49EC-4B45-9F82-3EE3D3FD1AF1"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.2.0.899:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71F02403-8202-4E23-994E-6199FC22E691"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.2.0.899:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7FF4E32-8DCE-4354-B850-94B26CF034A8"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.2.0.899:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACF42F3D-F22D-40A6-B130-9BC1721900CF"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}