Unscored severity · published Aug 19, 2015
CVE-2015-4298
Cisco Unified Web and E-Mail Interaction Manager 9.0(2) and 11.0(1) improperly performs authorization, which allows remote authenticated users to read or write to stored data via…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Cisco Unified Web and E-Mail Interaction Manager 9.0(2) and 11.0(1) improperly performs authorization, which allows remote authenticated users to read or write to stored data via unspecified vectors, aka Bug ID CSCuo89056.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UW
Unified Web And E-mail Interaction Manager · Cisco
9.0(2); 11.0(1) · source: NVD
Affected product
UW
Unified Web And E-mail Interaction Manager
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4298
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4298
Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=40428
Third Party Advisory
http://www.securityfocus.com/bid/76348
Third Party Advisory
http://www.securitytracker.com/id/1033286
More from Unified Web And E-mail Interaction Manager
–
CVE-2015-6416
Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web…
–
CVE-2015-6255
Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-Mail Interaction Manager 9.0(2) allows remote attackers to inject arbitrary web script or HTML via a crafted…
–
CVE-2015-4299
Cisco Unified Web and E-Mail Interaction Manager 9.0(2) improperly performs authorization, which allows remote authenticated users to remove default messaging-queue system folders…
–
CVE-2015-0753
SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL…
–
CVE-2015-0655
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web…