CVEvulnerability
CVE-2016-1290
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-04-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-264
Description
The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.
Affected configurations
• cisco evolved programmable network manager 1.2.0
• cisco prime infrastructure 1.2
• cisco prime infrastructure 1.2.0.103
• cisco prime infrastructure 1.2.1
• cisco prime infrastructure 1.3
• cisco prime infrastructure 1.3.0.20
• cisco prime infrastructure 1.4
• cisco prime infrastructure 1.4.0.45
• cisco prime infrastructure 1.4.1
• cisco prime infrastructure 1.4.2
• cisco prime infrastructure 2.0
• cisco prime infrastructure 2.1.0
• cisco prime infrastructure 2.2
• sun opensolaris snv 124
Related
Weakness · not in database (1)
References
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth Vendor Advisory
- http://www.securitytracker.com/id/1035498 www.securitytracker.com
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth Vendor Advisory
- http://www.securitytracker.com/id/1035498 www.securitytracker.com