CVE-2016-1290

Loading...

General

Score:5.5/10.0
Severity:Medium
Category:Access Control Error

Impact Metrics

Confidentiality:Partial
Integrity:Partial
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:Low
Authentication:Single

Published on 07/04/16 - Updated on 03/12/16

Description

The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.

Category: Access Control Error

CWE-264 (Permissions, Privileges, and Access Control)
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Security Notices

US National Vulnerability DatabaseCVE-2016-1290
Agence Nationale de la Sécurité des Systèmes d'Information CERTFR-2016-AVI-115

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
ciscoevolved_programmable_network_manager
ciscoprime_infrastructure

Share this vulnerability with:

Twitter Facebook LinkedIn Mail