SB2018121910 - Privilege escalation in Cisco Adaptive Security Appliance

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018121910

SB2018121910 - Privilege escalation in Cisco Adaptive Security Appliance

Published: December 19, 2018

Security Bulletin ID SB2018121910
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Privilege escalation (CVE-ID: CVE-2018-15465)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote authenticated but unprivileged attacker to gain elevated privileges on the target system.

The vulnerability exists in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software due to improper validation of user privileges when using the web management interface. A remote attacker can send specific HTTP requests via HTTPS to an affected device, retrieve files (including the running configuration) from the device or to upload and replace software images on the device with elevated privileges.


Remediation

Install update from vendor's website.

References