CVE-2016-1406
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.62% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284
- Affected
- cisco/evolved programmable network manager · cisco/prime infrastructure
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnmVendor Advisory
- http://www.securitytracker.com/id/1035948
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160523-pi-epnmVendor Advisory
- http://www.securitytracker.com/id/1035948
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.