SB2018121910 - Privilege escalation in Cisco Adaptive Security Appliance

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018121910

SB2018121910 - Privilege escalation in Cisco Adaptive Security Appliance

Published: December 19, 2018

Security Bulletin ID SB2018121910
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Privilege escalation (CVE-ID: CVE-2018-15465)

The vulnerability allows a remote authenticated but unprivileged attacker to gain elevated privileges on the target system.

The vulnerability exists in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software due to improper validation of user privileges when using the web management interface. A remote attacker can send specific HTTP requests via HTTPS to an affected device, retrieve files (including the running configuration) from the device or to upload and replace software images on the device with elevated privileges.


Remediation

Install update from vendor's website.

References