Sign-up

ID

VAR-201504-0262


CVE

CVE-2015-0666


TITLE

Cisco Prime Data Center Network Manager of fmserver Directory traversal vulnerability in servlets

Trust: 0.8

sources: JVNDB: JVNDB-2015-002075

DESCRIPTION

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241. Authentication is not required to exploit this vulnerability.The specific flaw exists within the fmserver servlet which is vulnerable to a directory traversal. An attacker can also bypass webapp authentication because the application writes access tokens to the filesystem, which can be read. Information harvested may aid in launching further attacks. This issue is being tracked by Cisco Bug ID CSCus00241. The manager provides multi-protocol management of the network and provides troubleshooting capabilities for switch health and performance

Trust: 2.7

sources: NVD: CVE-2015-0666 // JVNDB: JVNDB-2015-002075 // ZDI: ZDI-15-111 // BID: 73479 // VULHUB: VHN-78612 // VULMON: CVE-2015-0666

AFFECTED PRODUCTS

vendor:ciscomodel:prime data center network managerscope:eqversion:7.0\(1\)

Trust: 1.6

vendor:ciscomodel:prime data center network managerscope:eqversion:6.3\(2\)

Trust: 1.6

vendor:ciscomodel:prime data center network managerscope:eqversion:6.3\(1\)

Trust: 1.6

vendor:ciscomodel:prime data center network managerscope:lteversion:7.0\(2\)

Trust: 1.0

vendor:ciscomodel:prime data center network managerscope:ltversion:7.1

Trust: 0.8

vendor:ciscomodel:data center network managerscope: - version: -

Trust: 0.7

vendor:ciscomodel:prime data center network managerscope:eqversion:7.0\(2\)

Trust: 0.6

vendor:ciscomodel:prime data center network managerscope:eqversion:7.0(2)

Trust: 0.3

vendor:ciscomodel:prime data center network managerscope:eqversion:7.0(1)

Trust: 0.3

vendor:ciscomodel:prime data center network managerscope:eqversion:6.3(2)

Trust: 0.3

vendor:ciscomodel:prime data center network managerscope:eqversion:6.3(1)

Trust: 0.3

vendor:ciscomodel:prime data center network managerscope:neversion:7.1(1)

Trust: 0.3

sources: ZDI: ZDI-15-111 // BID: 73479 // JVNDB: JVNDB-2015-002075 // NVD: CVE-2015-0666 // CNNVD: CNNVD-201504-044

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2015-0666
value: HIGH

Trust: 1.8

ZDI: CVE-2015-0666
value: HIGH

Trust: 0.7

CNNVD: CNNVD-201504-044
value: HIGH

Trust: 0.6

VULHUB: VHN-78612
value: HIGH

Trust: 0.1

VULMON: CVE-2015-0666
value: HIGH

Trust: 0.1

NVD: CVE-2015-0666
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.6

NVD:
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

VULHUB: VHN-78612
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: ZDI: ZDI-15-111 // VULHUB: VHN-78612 // VULMON: CVE-2015-0666 // JVNDB: JVNDB-2015-002075 // NVD: CVE-2015-0666 // CNNVD: CNNVD-201504-044

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

sources: VULHUB: VHN-78612 // JVNDB: JVNDB-2015-002075 // NVD: CVE-2015-0666

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201504-044

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201504-044

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2015-0666

PATCH
title:cisco-sa-20150401-dcnmurl:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150401-dcnm
Trust: 1.5
title:5901/0url:http://tools.cisco.com/security/center/viewipssignature.x?signatureid=5901&signaturesubid=0&softwareversion=6.0&releaseversion=s860
Trust: 0.8
title:37810url:http://tools.cisco.com/security/center/viewalert.x?alertid=37810
Trust: 0.8
title:cisco-sa-20150401-dcnmurl:http://www.cisco.com/cisco/web/support/jp/112/1128/1128932_cisco-sa-20150401-dcnm-j.html
Trust: 0.8
title:Cisco Prime Data Center Network Manager Repair measures for path traversal vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqbyid.tag?id=221557
Trust: 0.6
title:Cisco: Cisco Prime Data Center Network Manager File Information Disclosure Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20150401-dcnm
Trust: 0.1
title:Check Point Security Alerts: Cisco Prime Data Center Network Manager Directory Traversal (CVE-2015-0666)url:https://vulmon.com/vendoradvisory?qidtp=check_point_security_alerts&qid=f5babc11f8c4e37273f23987ca08993b
Trust: 0.1
title:Known Exploited Vulnerabilities Detectorurl:https://github.com/ostorlab/kev 
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-111 // 
            
            
            
            VULMON: CVE-2015-0666 // 
            
            
            
            JVNDB: JVNDB-2015-002075 // 
            
            
            
            CNNVD: CNNVD-201504-044

EXTERNAL IDS
db:NVDid:CVE-2015-0666
Trust: 3.6
db:SECTRACKid:1032009
Trust: 1.2
db:ZDIid:ZDI-15-111
Trust: 1.0
db:JVNDBid:JVNDB-2015-002075
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-2573
Trust: 0.7
db:CNNVDid:CNNVD-201504-044
Trust: 0.7
db:AUSCERTid:ESB-2023.0220
Trust: 0.6
db:BIDid:73479
Trust: 0.4
db:VULHUBid:VHN-78612
Trust: 0.1
db:VULMONid:CVE-2015-0666
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-111 // 
            
            
            
            VULHUB: VHN-78612 // 
            
            
            
            VULMON: CVE-2015-0666 // 
            
            
            
            BID: 73479 // 
            
            
            
            JVNDB: JVNDB-2015-002075 // 
            
            
            
            NVD: CVE-2015-0666 // 
            
            
            
            CNNVD: CNNVD-201504-044

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150401-dcnm
Trust: 2.2
url:http://www.securitytracker.com/id/1032009
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0666
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0666
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2023.0220
Trust: 0.6
url:http://tools.cisco.com/security/center/viewalert.x?alertid=37810
Trust: 0.4
url:http://www.cisco.com/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-111/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/22.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/ostorlab/kev
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-111 // 
            
            
            
            VULHUB: VHN-78612 // 
            
            
            
            VULMON: CVE-2015-0666 // 
            
            
            
            BID: 73479 // 
            
            
            
            JVNDB: JVNDB-2015-002075 // 
            
            
            
            NVD: CVE-2015-0666 // 
            
            
            
            CNNVD: CNNVD-201504-044

CREDITS
Andrea Micalizzi (rgod)
Trust: 0.7
sources:
            
            
            ZDI: ZDI-15-111

SOURCES
db:ZDIid:ZDI-15-111
db:VULHUBid:VHN-78612
db:VULMONid:CVE-2015-0666
db:BIDid:73479
db:JVNDBid:JVNDB-2015-002075
db:NVDid:CVE-2015-0666
db:CNNVDid:CNNVD-201504-044

LAST UPDATE DATE
2023-12-26T22:44:43.672000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-15-111date:2015-04-03T00:00:00
db:VULHUBid:VHN-78612date:2015-09-29T00:00:00
db:VULMONid:CVE-2015-0666date:2015-09-29T00:00:00
db:BIDid:73479date:2015-05-07T17:27:00
db:JVNDBid:JVNDB-2015-002075date:2015-04-30T00:00:00
db:NVDid:CVE-2015-0666date:2015-09-29T19:31:23.037
db:CNNVDid:CNNVD-201504-044date:2023-01-16T00:00:00

SOURCES RELEASE DATE
db:ZDIid:ZDI-15-111date:2015-04-03T00:00:00
db:VULHUBid:VHN-78612date:2015-04-03T00:00:00
db:VULMONid:CVE-2015-0666date:2015-04-03T00:00:00
db:BIDid:73479date:2015-04-01T00:00:00
db:JVNDBid:JVNDB-2015-002075date:2015-04-07T00:00:00
db:NVDid:CVE-2015-0666date:2015-04-03T10:59:04.290
db:CNNVDid:CNNVD-201504-044date:2015-04-07T00:00:00