CVE-2015-4219: Infoleak
First published: Wed Jun 24 2015(Updated: )
Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | =1.0.4.573 | |
| Cisco Secure Access Control System | <=5.4.0.46.1 | |
| Cisco Secure Access Control System | =5.3.0.40.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-4219?
CVE-2015-4219 has been assigned a high severity level due to the potential for sensitive information disclosure.
How do I fix CVE-2015-4219?
To fix CVE-2015-4219, upgrade to Cisco Secure Access Control System version 5.4(0.46.2) or later, or 5.5 version 5.5(0.46) or later.
Who is affected by CVE-2015-4219?
CVE-2015-4219 affects Cisco Secure Access Control System versions up to 5.4(0.46.1) and Cisco Identity Services Engine version 1.0(4.573).
What types of attacks can exploit CVE-2015-4219?
CVE-2015-4219 can be exploited through remote authenticated attacks that leverage brute-force techniques to access sensitive information.
What protections can be implemented against CVE-2015-4219?
To protect against CVE-2015-4219, ensure that your system is updated to the latest available software version and implement robust access control measures.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/1.0.4.573
- canonical/cisco secure access control system
- version/cisco secure access control system/5.4.0.46.1
- version/cisco secure access control system/5.3.0.40.5