CVE-2015-4262

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-4262
The password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.5(5) MR3 and 8.6 before 8.6(2) does not check the session ID or require entry of the current password, which allows remote attackers to reset arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuu51839.

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-mp Vendor Advisory
http://www.securitytracker.com/id/1033024
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:6.0.417.0:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:6.0_base:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:7.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:7.0\(2\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:7.0\(2\)_sr1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:7.0\(3\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:7.1\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:7.1\(2\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.0\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.0\(1\)_sr1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.0\(2\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.5\(1\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.5\(2\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.5\(2\)_sr1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.5\(2\)_sr2:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.5\(3\):*:*:*:*:*:*:*
cpe:2.3:a:cisco:unified_meetingplace_web_conferencing:8.5\(4\):*:*:*:*:*:*:*
History

No history.

Information

Published : 2015-07-24 14:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-4262

Mitre link : CVE-2015-4262

CVE.ORG link : CVE-2015-4262

JSON object : View

Products Affected

cisco

  • unified_meetingplace_web_conferencing
CWE
CWE-255

Credentials Management Errors