CVE-2015-6404

{"id": "CVE-2015-6404", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-12-15T05:59:05.777", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-hcm", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/78874", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374."}, {"lang": "es", "value": "Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) no usa RBAC, lo que permite a usuarios remotos autenticados obtener informaci\u00f3n sensible de credenciales mediante el aprovechamiento de acceso de administrador y hacer solicitudes API de SOAP, tambi\u00e9n conocido como Bug ID CSCuw84374."}], "lastModified": "2016-11-28T19:39:01.797", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:hosted_collaboration_solution:10.6\\(3\\)_base:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D67E0764-0E79-49CF-A71B-EFC16606416B"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}