| Vulnerability Name: | CVE-2014-0678 (CCN-90732) | ||||||||
| Assigned: | 2014-01-24 | ||||||||
| Published: | 2014-01-24 | ||||||||
| Updated: | 2017-08-29 | ||||||||
| Summary: | The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951. | ||||||||
| CVSS v3 Severity: | 4.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 5.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N) 4.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C)
4.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2014-0678 Source: OSVDB Type: UNKNOWN 102558 Source: CCN Type: SA56540 Cisco Secure Access Control System (ACS) Portal Session Management Vulnerability Source: SECUNIA Type: UNKNOWN 56540 Source: CCN Type: Cisco Security Notice Cisco Secure ACS Portal Session Management Vulnerability Source: CISCO Type: Vendor Advisory 20140124 Cisco Secure ACS Portal Session Management Vulnerability Source: CONFIRM Type: Vendor Advisory http://tools.cisco.com/security/center/viewAlert.x?alertId=32567 Source: BID Type: Third Party Advisory, VDB Entry 65144 Source: CCN Type: BID-65144 Cisco Secure Access Control System Portal Interface Access Security Bypass Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry 1029688 Source: XF Type: UNKNOWN cisco-acs-cve20140678-unauth-access(90732) Source: XF Type: UNKNOWN cisco-acs-cve20140678-unauth-access(90732) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||