| Vulnerability Name: | CVE-2015-4235 (CCN-104952) | ||||||||
| Assigned: | 2015-07-22 | ||||||||
| Published: | 2015-07-22 | ||||||||
| Updated: | 2017-09-21 | ||||||||
| Summary: | Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3o) and 1.1 before 1.1(1j) and Nexus 9000 ACI devices with software before 11.0(4o) and 11.1 before 11.1(1j) do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain root privileges via unspecified use of the APIC cluster-management configuration feature, aka Bug IDs CSCuu72094 and CSCuv11991. | ||||||||
| CVSS v3 Severity: | 8.0 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C) 6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
6.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2015-4235 Source: CCN Type: Cisco Security Advisory ID: cisco-sa-20150722-apic Cisco Application Policy Infrastructure Controller Access Control Vulnerability Source: CISCO Type: Vendor Advisory 20150722 Cisco Application Policy Infrastructure Controller Access Control Vulnerability Source: SECTRACK Type: UNKNOWN 1033025 Source: XF Type: UNKNOWN cisco-apic-cve20154235-unauth-access(104952) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||