-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco ASA-CX and Cisco Prime Security Manager Privilege Escalation Vulnerability Advisory ID: cisco-sa-20160203-prsm Revision: 1.0 For Public Release 2016 February 03 16:00 UTC (GMT) +--------------------------------------------------------------------- Summary ======= A vulnerability in the role-based access control of Cisco ASA-CX and Cisco Prime Security Manager (PRSM) could allow an authenticated, remote attacker to change the password of any user on the system. The vulnerability exists because the password change request is not fully qualified. An authenticated attacker with a user role other than Administrator could exploit this vulnerability by sending a specially crafted HTTP request to the Cisco PRSM. An exploit could allow the attacker to change the password of any user on the system, including users with the Administrator role. Cisco has released software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-prsm -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (SunOS) iQIVAwUBVrChQq89gD3EAJB5AQJu2A//cangLN7tBQmXdH9dVqxeGRG/Ui0TX5PM e7owNoX4Z579zbkVUCJ2D5pvwWHTkG+2LUvXKpcv+93K5/Gl4U8jMCDcndtOzKuD PV65FpVNEimFc07DdIFhQgdHEfOuLKvNxj3qwAlRha4d9cR/HCWLh4yEdMi/zbR+ IOyFntTZaf5jK0VzvihzoMIVGuoPmus+RdT2hmw4FivQu1xqAZ/28j3gJrV3PISK Icq4aloxGo3PhAR/LpQ27QAMypa9GiDCp/pkI7Isc+1w+uSV+vEulO5BSW9g/000 wXMCmZWh/1QoOh0ldhuEwlgVQo+BR2SfZeFagP4iFfHfaTYmUmCbUlgkI0jZv7XD 57QIG7LyYC1bDwud9Fg6lfmmKNhlfREA//AleZAFA9k+i8axRXwMAZ3XhCUPDAb9 A2KxldXfyGAXKqOcJctWKmqotgvFOVz4qQVM2Ay0YNsV0D2vyZONpaovW1qAVr5g zE8d0570+XqMZ+6ZnpeDCNRMI+xLH0WlA01+tgJgS6txhn/Y+7OTQHmSn35ddBnA ZYSy4REVX/2ZXsJ7LnoORj65MkwZiSCKilJtVMAk7AkdBaBAuGrHQdvT8MPgpfkl 0noBwidC3oS5aidyM0+HCrX/X1q9QZcTbgBWQ271Nq4Qg9nmakRA2eUIP7YFqNnU vf+cvrpb7+U= =XzN9 -----END PGP SIGNATURE-----
