Information disclosure in Cisco Hosted_collaboration_solution

CVE-2015-6404

Cisco Hosted Collaboration Mediation Fulfillment 10.6(3) does not use RBAC, which allows remote authenticated users to obtain sensitive credential information by leveraging admin access and making SOAP API requests, aka Bug ID CSCuw84374.

Vulnerability class: Information Disclosure

EPSS: 0.002 (38.9th percentile) — read the EPSS interpretation.

Affected products

Cisco Hosted_collaboration_solution — versions 10.6\(3\)_base
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

78874 (vdb-entry, x_refsource_BID)
20151210 Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability (x_refsource_CISCO, vendor-advisory, Vendor Advisory)