Details of VAR-201512-0411

ID

VAR-201512-0411

CVE

CVE-2015-6404

TITLE

Cisco Hosted Collaboration Mediation Fulfillment Vulnerable to obtaining important credentials

Trust: 0.8

sources: JVNDB: JVNDB-2015-006446

DESCRIPTION

Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374. Cisco Hosted Collaboration Mediation Fulfillment Is RBAC Vulnerabilities exist in which important credentials are obtained. An attacker may leverage these issues to obtain authentication credential and other sensitive information.This may aid in further attacks. This issue is being tracked by Cisco bug ID CSCuw84374. The software provides functions such as configuring, managing and monitoring services of Cisco HCM-F. There is a security vulnerability in Cisco HCM-F 10.6(3), which is caused by the fact that the program does not use RBAC authority management

Trust: 1.98

sources: NVD: CVE-2015-6404 // JVNDB: JVNDB-2015-006446 // BID: 78874 // VULHUB: VHN-84365

AFFECTED PRODUCTS

vendor:	cisco	model:	hosted collaboration solution	scope:	eq	version:	10.6\(3\)_base	Trust: 1.6
vendor:	cisco	model:	hosted collaboration mediation fulfillment	scope:	eq	version:	10.6(3)	Trust: 1.1

sources: BID: 78874 // JVNDB: JVNDB-2015-006446 // CNNVD: CNNVD-201512-417 // NVD: CVE-2015-6404

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-6404
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-6404
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201512-417
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-84365
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-6404
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-84365
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-84365 // JVNDB: JVNDB-2015-006446 // CNNVD: CNNVD-201512-417 // NVD: CVE-2015-6404

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-84365 // JVNDB: JVNDB-2015-006446 // NVD: CVE-2015-6404

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201512-417

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201512-417

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-006446

PATCH

title:	cisco-sa-20151210-hcm	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-hcm	Trust: 0.8
title:	Cisco Hosted Collaboration Mediation Fulfillment Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59228	Trust: 0.6

sources: JVNDB: JVNDB-2015-006446 // CNNVD: CNNVD-201512-417

EXTERNAL IDS

db:	NVD	id:	CVE-2015-6404	Trust: 2.8
db:	BID	id:	78874	Trust: 2.0
db:	JVNDB	id:	JVNDB-2015-006446	Trust: 0.8
db:	CNNVD	id:	CNNVD-201512-417	Trust: 0.7
db:	VULHUB	id:	VHN-84365	Trust: 0.1

sources: VULHUB: VHN-84365 // BID: 78874 // JVNDB: JVNDB-2015-006446 // CNNVD: CNNVD-201512-417 // NVD: CVE-2015-6404

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20151210-hcm	Trust: 2.0
url:	http://www.securityfocus.com/bid/78874	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6404	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6404	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-84365 // BID: 78874 // JVNDB: JVNDB-2015-006446 // CNNVD: CNNVD-201512-417 // NVD: CVE-2015-6404

CREDITS

Cisco

Trust: 0.9

sources: BID: 78874 // CNNVD: CNNVD-201512-417

SOURCES

db:	VULHUB	id:	VHN-84365
db:	BID	id:	78874
db:	JVNDB	id:	JVNDB-2015-006446
db:	CNNVD	id:	CNNVD-201512-417
db:	NVD	id:	CVE-2015-6404

LAST UPDATE DATE

2025-04-12T23:35:04.392000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-84365	date:	2016-11-28T00:00:00
db:	BID	id:	78874	date:	2015-12-10T00:00:00
db:	JVNDB	id:	JVNDB-2015-006446	date:	2015-12-18T00:00:00
db:	CNNVD	id:	CNNVD-201512-417	date:	2015-12-16T00:00:00
db:	NVD	id:	CVE-2015-6404	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-84365	date:	2015-12-15T00:00:00
db:	BID	id:	78874	date:	2015-12-10T00:00:00
db:	JVNDB	id:	JVNDB-2015-006446	date:	2015-12-18T00:00:00
db:	CNNVD	id:	CNNVD-201512-417	date:	2015-12-15T00:00:00
db:	NVD	id:	CVE-2015-6404	date:	2015-12-15T05:59:05.777