9
CVSSv2

CVE-2016-1302

Published: 07/02/2016 Updated: 06/12/2016
CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 801
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

Vulnerability Summary

Cisco Application Policy Infrastructure Controller (APIC) devices with software prior to 1.0(3h) and 1.1 prior to 1.1(1j) and Nexus 9000 ACI Mode switches with software prior to 11.0(3h) and 11.1 prior to 11.1(1j) allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka Bug ID CSCut12998.

Vulnerable Product Search on Vulmon Subscribe to Product

cisco application policy infrastructure controller 1.0\\\\\\(1k\\\\\\)

cisco application policy infrastructure controller 1.0\\\\\\(1h\\\\\\)

cisco application policy infrastructure controller 1.0\\\\\\(3f\\\\\\)

cisco application policy infrastructure controller 1.0\\\\\\(2m\\\\\\)

cisco application policy infrastructure controller 1.0\\\\\\(2j\\\\\\)

cisco application policy infrastructure controller 1.0\\\\\\(1n\\\\\\)

cisco application policy infrastructure controller 1.0\\\\\\(1e\\\\\\)

cisco application policy infrastructure controller 1.1\\\\\\(0.920a\\\\\\)

cisco nx-os 11.0\\\\\\(3f\\\\\\)

cisco nx-os 11.0\\\\\\(2m\\\\\\)

cisco nx-os 11.0\\\\\\(1d\\\\\\)

cisco nx-os 11.0\\\\\\(1c\\\\\\)

cisco nx-os base

cisco nx-os 11.0\\\\\\(1b\\\\\\)

cisco nx-os 11.0\\\\\\(2j\\\\\\)

cisco nx-os 11.0\\\\\\(1e\\\\\\)

Vendor Advisories

A vulnerability in the role-based access control (RBAC) of the Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated remote user to make configuration changes outside of their configured access privileges The vulnerability is due to eligibility logic in the RBAC processing code An authenticated user could explo ...