CVE-2016-1290: High severity cisco evolved programmable network manager vulnerability
The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1290?
CVE-2016-1290 has a medium severity rating due to its potential to allow privilege escalation for remote authenticated users.
How do I fix CVE-2016-1290?
To fix CVE-2016-1290, upgrade your Cisco Prime Infrastructure or Cisco Evolved Programmable Network Manager to a version that includes the necessary security patches.
Who is affected by CVE-2016-1290?
CVE-2016-1290 affects remote authenticated users of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager versions up to 2.2(2).
What types of privileges can be gained through CVE-2016-1290?
CVE-2016-1290 allows users to bypass role-based access control (RBAC) restrictions, potentially gaining unauthorized access to sensitive operations.
What action should organizations take regarding CVE-2016-1290?
Organizations should evaluate their use of affected Cisco products and implement the recommended upgrades to mitigate the risks associated with CVE-2016-1290.