CVE-2016-1442

The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160706-pi	Vendor Advisory
http://www.securitytracker.com/id/1036238

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:prime_infrastructure:3.0:::::::*
	cpe:2.3:a:cisco:prime_infrastructure:3.1:::::::*

History

No history.

Information

Published : 2016-07-07 14:59

Updated : 2019-07-29 17:46

NVD link : CVE-2016-1442

Mitre link : CVE-2016-1442

CVE.ORG link : CVE-2016-1442

JSON object : View

Products Affected

cisco

prime_infrastructure

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2016-1442", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2016-07-07T14:59:03.063", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160706-pi", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1036238", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The administrative web interface in Cisco Prime Infrastructure (PI) before 3.1.1 allows remote authenticated users to execute arbitrary commands via crafted field values, aka Bug ID CSCuy96280."}, {"lang": "es", "value": "La interf\u00e1z de web administrativa en Cisco Prime Infrastructure (PI) en versiones anteriores a 3.1.1 permite a usuarios remotos autenticados ejecutar comandos arbitrarios a trav\u00e9s de valores de campo manipulados, tambi\u00e9n conocido como Bug ID CSCuy96280."}], "lastModified": "2019-07-29T17:46:19.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:prime_infrastructure:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48F3C5A5-6C84-408D-B59A-265F8775C943"}, {"criteria": "cpe:2.3:a:cisco:prime_infrastructure:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27F4F1D6-82DA-4675-B734-D9C5371E6654"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}