Published: 04/04/2011 Updated: 17/08/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 540

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 prior to 5.1.0.44.6 and 5.2 prior to 5.2.0.26.3 allows remote malicious users to change arbitrary user passwords via unspecified vectors, aka Bug ID CSCtl77440.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco secure access control system 5.1.0.44.1
cisco secure access control system 5.1.0.44.2
cisco secure access control system 5.2.0.26.2
cisco secure access control system 5.1.0.44.3
cisco secure access control system 5.1.0.44.4
cisco secure access control system 5.1
cisco secure access control system 5.1.0.44
cisco secure access control system 5.2.0.26
cisco secure access control system 5.2.0.26.1
cisco secure access control system 5.1.0.44.5
cisco secure access control system 5.2

A vulnerability exists in some Cisco Secure Access Control System (ACS) versions that could allow a remote, unauthenticated attacker to change the password of any user account to any value without providing the account's previous password Successful exploitation requires the user account to be defined on the internal identity store This vulnerab ...

Cisco Secure Access Control System (ACS) contains a vulnerability that could allow an unauthenticated, remote attacker to modify user passwords The vulnerability is due to improper security restrictions on user password change functions in the web-based management interface of the Cisco Secure ACS application An unauthenticated, remote attacker ...

CWE-255 http://www.securityfocus.com/bid/47093 http://www.cisco.com/en/US/products/products_security_advisory09186a0080b74117.shtml http://securitytracker.com/id?1025271 http://www.vupen.com/english/advisories/2011/0821 http://secunia.com/advisories/43924 https://exchange.xforce.ibmcloud.com/vulnerabilities/66471 https://nvd.nist.gov http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110330-acs

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2011-0951

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect