Unscored severity · published Apr 17, 2015
CVE-2015-0700
Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5)…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Secure Access Control Server Solution Engine · Cisco
5.4.0.46.6; 5.5.0.36; 5.5.0.46.4 · source: NVD
Affected product
SA
Secure Access Control Server Solution Engine
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0700
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0700
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=38403
Third Party Advisory
http://www.securitytracker.com/id/1032163
More from Secure Access Control Server Solution Engine
5.7
CVE-2018-0414
A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected…
3.3
CVE-2018-0218
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access…
3.3
CVE-2018-0207
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access…
–
CVE-2013-3380
The administrative web interface in the Access Control Server in Cisco Secure Access Control System (ACS) does not properly restrict the report view page, which allows remote…