CVE-2014-0678

The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678	Vendor Advisory
http://www.securitytracker.com/id/1029688	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/65144	Third Party Advisory VDB Entry
http://osvdb.org/102558
http://tools.cisco.com/security/center/viewAlert.x?alertId=32567	Vendor Advisory
http://secunia.com/advisories/56540
https://exchange.xforce.ibmcloud.com/vulnerabilities/90732

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:secure_access_control_system:-:*:*:*:*:*:*:*

Information

Published : 2014-01-25 14:55

Updated : 2017-08-28 18:34

NVD link : CVE-2014-0678

Mitre link : CVE-2014-0678

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

cisco

secure_access_control_system

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678", "name": "20140124 Cisco Secure ACS Portal Session Management Vulnerability", "tags": ["Vendor Advisory"], "refsource": "CISCO"}, {"url": "http://www.securitytracker.com/id/1029688", "name": "1029688", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/65144", "name": "65144", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://osvdb.org/102558", "name": "102558", "tags": [], "refsource": "OSVDB"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32567", "name": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32567", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/56540", "name": "56540", "tags": [], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90732", "name": "cisco-acs-cve20140678-unauth-access(90732)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-0678", "ASSIGNER": "psirt@cisco.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-01-25T22:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:secure_access_control_system:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-29T01:34Z"}

5.5 /10