CVE-2015-6266 Missing authorization in n/a
Remote attackers can access sensitive information from uploaded HTML documents on the Cisco ISE guest portal without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-6266?
CVE-2015-6266 is a medium-severity missing authorization vulnerability in n/a, published on 28 Aug 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka Bug ID CSCuo78045.
Weakness: CWE-287
Which versions are affected by CVE-2015-6266?
It affects 1 product.
Products include Cisco Identity Services Engine Software.
How do I fix CVE-2015-6266?
No fix has been published for CVE-2015-6266 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-6266 being exploited?
There is no known exploitation of CVE-2015-6266 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9hx7-74mf-ww6x.