Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG and 3.2.xSG before 3.2.2SG, when AAA authorization is enabled, allow remote authenticated users to bypass intended access restrictions and execute commands via a (1) HTTP or (2) HTTPS session, aka Bug ID CSCtr91106.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG and 3.2.xSG before 3.2.2SG, when AAA authorization is enabled, allow remote authenticated users to bypass intended access restrictions and execute commands via a (1) HTTP or (2) HTTPS session, aka Bug ID CSCtr91106.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://osvdb.org/80704 | vdb-entry x_refsource_OSVDB |
| http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai | vendor-advisory x_refsource_CISCO |
| http://www.securitytracker.com/id?1026860 | vdb-entry x_refsource_SECTRACK |
| http://secunia.com/advisories/48614 | third-party-advisory x_refsource_SECUNIA |
| http://www.securityfocus.com/bid/52755 | vdb-entry x_refsource_BID |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://osvdb.org/80704 | vdb-entry x_refsource_OSVDB x_transferred |
| http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai | vendor-advisory x_refsource_CISCO x_transferred |
| http://www.securitytracker.com/id?1026860 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://secunia.com/advisories/48614 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.securityfocus.com/bid/52755 | vdb-entry x_refsource_BID x_transferred |
Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG and 3.2.xSG before 3.2.2SG, when AAA authorization is enabled, allow remote authenticated users to bypass intended access restrictions and execute commands via a (1) HTTP or (2) HTTPS session, aka Bug ID CSCtr91106.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.1 | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Primary | 2.0 | 8.5 | HIGH | AV:N/AC:M/Au:S/C:C/I:C/A:C |
| Hyperlink | Source | Resource |
|---|---|---|
| http://osvdb.org/80704 | psirt@cisco.com | Broken Link |
| http://secunia.com/advisories/48614 | psirt@cisco.com | Third Party Advisory |
| http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai | psirt@cisco.com | Vendor Advisory |
| http://www.securityfocus.com/bid/52755 | psirt@cisco.com | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id?1026860 | psirt@cisco.com | Third Party Advisory VDB Entry |
| http://osvdb.org/80704 | af854a3a-2127-422b-91ae-364da2661108 | Broken Link |
| http://secunia.com/advisories/48614 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory |
| http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai | af854a3a-2127-422b-91ae-364da2661108 | Vendor Advisory |
| http://www.securityfocus.com/bid/52755 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id?1026860 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |