CVE-2015-6417

Published: Dec 12, 2015Modified: May 6, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

Cisco Videoscape Distribution Suite Service Manager (VDS-SM) 3.4.0 and earlier does not always use RBAC for backend database access, which allows remote authenticated users to read or write to database entries via (1) the GUI or (2) a crafted HTTP request, aka Bug ID CSCuv87025.

Affected (5)

Products: Cisco: Videoscape Distribution Suite Service Manager

Cisco

1 product

Videoscape Distribution Suite Service Manager

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Cisco Videoscape Distribution Suite Service Manager	Version 3.0.0
Cisco Videoscape Distribution Suite Service Manager	Version 3.1.0
Cisco Videoscape Distribution Suite Service Manager	Version 3.2.0
Cisco Videoscape Distribution Suite Service Manager	Version 3.3.0
Cisco Videoscape Distribution Suite Service Manager	Version 3.4.0

Related CWEs

CWE-264

References (4)

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-vdssm

Source: psirt@cisco.com

Vendor Advisory

http://www.securityfocus.com/bid/78871

Source: psirt@cisco.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-vdssm

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/78871

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.