CVE-2012-3063 Missing authorization in n/a
Remote authenticated administrators can bypass access restrictions to read or modify configuration settings in Cisco ACE devices when multicontext mode is enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-3063?
CVE-2012-3063 is a high-severity missing authorization vulnerability in n/a, published on 20 Jun 2012. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Cisco Application Control Engine (ACE) before A4(2.3) and A5 before A5(1.1), when multicontext mode is enabled, does not properly share a management IP address among multiple contexts, which allows remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances, and read or modify configuration settings, via a login attempt to a context, aka Bug ID CSCts30631, a different vulnerability than CVE-2012-3058.
Weakness: CWE-362
Which versions are affected by CVE-2012-3063?
It affects 1 product.
Products include Cisco Application Control Engine Software.
How do I fix CVE-2012-3063?
No fix has been published for CVE-2012-3063 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2012-3063 being exploited?
There is no known exploitation of CVE-2012-3063 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7gv3-h552-264c.