Privilege escalation in Cisco Adaptive Security Appliance (ASA) - CVE-2018-15465
Published: December 19, 2018 / Updated: December 24, 2018
Vulnerability identifier: #VU16625
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-15465
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated but unprivileged attacker to gain elevated privileges on the target system.
The vulnerability exists in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software due to improper validation of user privileges when using the web management interface. A remote attacker can send specific HTTP requests via HTTPS to an affected device, retrieve files (including the running configuration) from the device or to upload and replace software images on the device with elevated privileges.
Affected software
Cisco Adaptive Security Appliance (ASA)
How to mitigate CVE-2018-15465
The vulnerability has been addressed in the versions 9.4.4.29, 9.6.4.20, 9.8.3.18, 9.9.2.36, 9.10.1.7.
Cisco Adaptive Security Appliance (ASA) - addressed in versions 9.4.4.29, 9.6.4.20, 9.8.3.18, 9.9.2.36, 9.10.1.7