CVE-2015-6395 Missing authorization in n/a
Remote attackers can modify the configuration of Cisco Prime Service Catalog by sending direct requests to unprotected web pages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-6395?
CVE-2015-6395 is a medium-severity missing authorization vulnerability in n/a, published on 12 Dec 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify the configuration via a direct request, aka Bug ID CSCuw48188.
Weakness: CWE-264
Which versions are affected by CVE-2015-6395?
It affects 1 product.
Products include Cisco Prime Service Catalog.
How do I fix CVE-2015-6395?
No fix has been published for CVE-2015-6395 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-6395 being exploited?
There is no known exploitation of CVE-2015-6395 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-1874 Cisco Prime Service Catalog Cross-Site Request Forgery Vulnerability
- CVE-2018-0107 Cross-site request forgery in Cisco Prime Service Catalog
- CVE-2015-0581 XML external entity in n/a
- CVE-2018-0285 Denial of service in Cisco Prime Service Catalog
- CVE-2017-12364 SQL injection in Cisco Prime Service Catalog
Sources
Also known as GHSA-m97x-rfxh-9ppm.