CVE-2016-1290 (GCVE-0-2016-1290)
Vulnerability from cvelistv5 – Published: 2016-04-06 23:00 – Updated: 2024-08-05 22:48
VLAI?
Summary
The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:48:13.675Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1035498",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1035498"
},
{
"name": "20160406 Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-04-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-30T18:57:01",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "1035498",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1035498"
},
{
"name": "20160406 Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"ID": "CVE-2016-1290",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1035498",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035498"
},
{
"name": "20160406 Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability",
"refsource": "CISCO",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2016-1290",
"datePublished": "2016-04-06T23:00:00",
"dateReserved": "2016-01-04T00:00:00",
"dateUpdated": "2024-08-05T22:48:13.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C057764-0A1B-41A9-A21B-F665480145AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BA72A91C-0E65-420A-9DBE-3E0853EDB7C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.2.0.103:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B257E2F8-30EB-4BCC-8ACF-35DF73107AAC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B48C1E6-7C18-4C6B-B402-9C0E1A931C2C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B64A7FCA-1DEA-45B2-9C69-CCDCC848D9B3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.3.0.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E78D776C-AA8C-471D-A0C0-02428FA07A29\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9D3206E7-DC91-4861-AD32-46DA82509D5B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.4.0.45:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1704AC8E-BD7E-4882-8BB3-45B9E2AE0F10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9ACB00E7-41E3-4221-8400-A279A75FD355\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:1.4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"853315C7-01A7-4E83-9CBB-D45F6B5C4664\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB157A80-3A03-4B8D-9B20-C456A953CF7E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:2.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7678B118-E00C-4B1E-8B40-D3233DE3615C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56394A07-6D74-4588-8C05-DE04959F7FC7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:sun:opensolaris:snv_124:*:sparc:*:*:*:*:*\", \"matchCriteriaId\": \"09B35C0E-6CBA-4B6B-BCD2-F5CC0BF8CF53\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.\"}, {\"lang\": \"es\", \"value\": \"La API web en Cisco Prime Infrastructure 1.2.0 hasta la versi\\u00f3n 2.2(2) y Cisco Evolved Programmable Network Manager (EPNM) 1.2 permite a usuarios remotos autenticados eludir restricciones RBAC previstas y obtener privilegios a trav\\u00e9s de una petici\\u00f3n HTTP que es inconsistente con un patr\\u00f3n de filtro, tambi\\u00e9n conocido como Bug ID CSCuy10227.\"}]",
"id": "CVE-2016-1290",
"lastModified": "2024-11-21T02:46:07.610",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.2}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:N\", \"baseScore\": 5.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false}]}",
"published": "2016-04-06T23:59:10.910",
"references": "[{\"url\": \"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securitytracker.com/id/1035498\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securitytracker.com/id/1035498\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2016-1290\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2016-04-06T23:59:10.910\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.\"},{\"lang\":\"es\",\"value\":\"La API web en Cisco Prime Infrastructure 1.2.0 hasta la versi\u00f3n 2.2(2) y Cisco Evolved Programmable Network Manager (EPNM) 1.2 permite a usuarios remotos autenticados eludir restricciones RBAC previstas y obtener privilegios a trav\u00e9s de una petici\u00f3n HTTP que es inconsistente con un patr\u00f3n de filtro, tambi\u00e9n conocido como Bug ID CSCuy10227.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:N\",\"baseScore\":5.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C057764-0A1B-41A9-A21B-F665480145AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA72A91C-0E65-420A-9DBE-3E0853EDB7C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.2.0.103:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B257E2F8-30EB-4BCC-8ACF-35DF73107AAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B48C1E6-7C18-4C6B-B402-9C0E1A931C2C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B64A7FCA-1DEA-45B2-9C69-CCDCC848D9B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.3.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E78D776C-AA8C-471D-A0C0-02428FA07A29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D3206E7-DC91-4861-AD32-46DA82509D5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.4.0.45:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1704AC8E-BD7E-4882-8BB3-45B9E2AE0F10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9ACB00E7-41E3-4221-8400-A279A75FD355\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:1.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"853315C7-01A7-4E83-9CBB-D45F6B5C4664\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB157A80-3A03-4B8D-9B20-C456A953CF7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7678B118-E00C-4B1E-8B40-D3233DE3615C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56394A07-6D74-4588-8C05-DE04959F7FC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:sun:opensolaris:snv_124:*:sparc:*:*:*:*:*\",\"matchCriteriaId\":\"09B35C0E-6CBA-4B6B-BCD2-F5CC0BF8CF53\"}]}]}],\"references\":[{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securitytracker.com/id/1035498\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-privauth\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securitytracker.com/id/1035498\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…