Vulnerability Details : CVE-2015-4219
Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331.
Vulnerability category: Information leak
Products affected by CVE-2015-4219
- cpe:2.3:a:cisco:secure_access_control_system:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.5:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:identity_services_engine_software:1.0.4.573:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-4219
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 56 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-4219
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST |
CWE ids for CVE-2015-4219
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-4219
-
http://www.securitytracker.com/id/1032714
Cisco Identity Services Engine Access Control Flaw Lets Remote Authenticated Users Access Data - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/75379
Multiple Cisco Products CVE-2015-4219 Unauthorized Access VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1032713
Cisco Secure Access Control Server Access Control Flaw Lets Remote Authenticated Users Access Data - SecurityTrackerThird Party Advisory;VDB Entry
-
http://tools.cisco.com/security/center/viewAlert.x?alertId=39501
Cisco Identity Services Engine and Secure Access Control System Support Bundle Download VulnerabilityVendor Advisory
Jump to