Description
The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://www.korelogic.com/Resources/Advisories/KL-001-2016-007.txt ↗
- http://www.securityfocus.com/bid/93414 ↗
- https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking ↗
- https://www.exploit-db.com/exploits/40463/ ↗
- https://www.exploit-db.com/exploits/41041/ ↗
- http://packetstormsecurity.com/files/140467/Cisco-Firepower-Management-Console-6.0-Post-Authentication-UserAdd.html ↗
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc ↗