Details of VAR-201505-0174

ID

VAR-201505-0174

CVE

CVE-2015-0728

TITLE

Cisco Access Control Server Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2015-002701

DESCRIPTION

Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug ID CSCuu11002. The solution supports certification revocation list (CRL), device access permission setting and user profile verification, etc

Trust: 1.98

sources: NVD: CVE-2015-0728 // JVNDB: JVNDB-2015-002701 // BID: 74653 // VULHUB: VHN-78674

AFFECTED PRODUCTS

vendor:	cisco	model:	secure access control system	scope:	eq	version:	5.5\(0.1\)	Trust: 1.6
vendor:	cisco	model:	secure access control server software	scope:	eq	version:	5.5(0.1)	Trust: 0.8
vendor:	cisco	model:	secure access control server solution engine	scope:	eq	version:	5.5(0.1)	Trust: 0.3

sources: BID: 74653 // JVNDB: JVNDB-2015-002701 // CNNVD: CNNVD-201505-236 // NVD: CVE-2015-0728

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-0728
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-0728
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201505-236
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-78674
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-0728
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-78674
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-78674 // JVNDB: JVNDB-2015-002701 // CNNVD: CNNVD-201505-236 // NVD: CVE-2015-0728

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-78674 // JVNDB: JVNDB-2015-002701 // NVD: CVE-2015-0728

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201505-236

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201505-236

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-002701

PATCH

title:

38808

url:

http://tools.cisco.com/security/center/viewAlert.x?alertId=38808

Trust: 0.8

sources: JVNDB: JVNDB-2015-002701

EXTERNAL IDS

db:	NVD	id:	CVE-2015-0728	Trust: 2.8
db:	SECTRACK	id:	1032328	Trust: 1.1
db:	JVNDB	id:	JVNDB-2015-002701	Trust: 0.8
db:	CNNVD	id:	CNNVD-201505-236	Trust: 0.7
db:	SECUNIA	id:	64490	Trust: 0.6
db:	BID	id:	74653	Trust: 0.4
db:	VULHUB	id:	VHN-78674	Trust: 0.1

sources: VULHUB: VHN-78674 // BID: 74653 // JVNDB: JVNDB-2015-002701 // CNNVD: CNNVD-201505-236 // NVD: CVE-2015-0728

REFERENCES

url:	http://tools.cisco.com/security/center/viewalert.x?alertid=38808	Trust: 2.0
url:	http://www.securitytracker.com/id/1032328	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0728	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0728	Trust: 0.8
url:	http://secunia.com/advisories/64490	Trust: 0.6
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-78674 // BID: 74653 // JVNDB: JVNDB-2015-002701 // CNNVD: CNNVD-201505-236 // NVD: CVE-2015-0728

CREDITS

Cisco

Trust: 0.3

sources: BID: 74653

SOURCES

db:	VULHUB	id:	VHN-78674
db:	BID	id:	74653
db:	JVNDB	id:	JVNDB-2015-002701
db:	CNNVD	id:	CNNVD-201505-236
db:	NVD	id:	CVE-2015-0728

LAST UPDATE DATE

2025-04-13T23:31:34.620000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-78674	date:	2017-01-06T00:00:00
db:	BID	id:	74653	date:	2015-05-13T00:00:00
db:	JVNDB	id:	JVNDB-2015-002701	date:	2015-05-19T00:00:00
db:	CNNVD	id:	CNNVD-201505-236	date:	2015-05-15T00:00:00
db:	NVD	id:	CVE-2015-0728	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-78674	date:	2015-05-15T00:00:00
db:	BID	id:	74653	date:	2015-05-13T00:00:00
db:	JVNDB	id:	JVNDB-2015-002701	date:	2015-05-19T00:00:00
db:	CNNVD	id:	CNNVD-201505-236	date:	2015-05-15T00:00:00
db:	NVD	id:	CVE-2015-0728	date:	2015-05-15T01:59:05.283