9.3

CVE-2015-0691

A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Secure Desktop Version 3.0_base
Cisco ≫ Secure Desktop Version 3.1.0.31
Cisco ≫ Secure Desktop Version 3.1.1
Cisco ≫ Secure Desktop Version 3.1.1.45
Cisco ≫ Secure Desktop Version 3.1_base
Cisco ≫ Secure Desktop Version 3.2.0.136
Cisco ≫ Secure Desktop Version 3.2.1.103
Cisco ≫ Secure Desktop Version 3.2.1.126
Cisco ≫ Secure Desktop Version 3.2_base
Cisco ≫ Secure Desktop Version 3.3.0.118
Cisco ≫ Secure Desktop Version 3.3.0.151
Cisco ≫ Secure Desktop Version 3.3_base
Cisco ≫ Secure Desktop Version 3.4.0373
Cisco ≫ Secure Desktop Version 3.4.1108
Cisco ≫ Secure Desktop Version 3.4.2048
Cisco ≫ Secure Desktop Version 3.4_base
Cisco ≫ Secure Desktop Version 3.5.841
Cisco ≫ Secure Desktop Version 3.5.1077
Cisco ≫ Secure Desktop Version 3.5.2001
Cisco ≫ Secure Desktop Version 3.5.2003
Cisco ≫ Secure Desktop Version 3.5.2008
Cisco ≫ Secure Desktop Version 3.5_base
Cisco ≫ Secure Desktop Version 3.6.181
Cisco ≫ Secure Desktop Version 3.6.185
Cisco ≫ Secure Desktop Version 3.6.1001
Cisco ≫ Secure Desktop Version 3.6.2002
Cisco ≫ Secure Desktop Version 3.6.3002
Cisco ≫ Secure Desktop Version 3.6.4021
Cisco ≫ Secure Desktop Version 3.6.5005
Cisco ≫ Secure Desktop Version 3.6.6020
Cisco ≫ Secure Desktop Version 3.6.6104
Cisco ≫ Secure Desktop Version 3.6.6203
Cisco ≫ Secure Desktop Version 3.6.6210
Cisco ≫ Secure Desktop Version 3.6.6228
Cisco ≫ Secure Desktop Version 3.6.6234
Cisco ≫ Secure Desktop Version 3.6.6249
Cisco ≫ Secure Desktop Version 3.6_base
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.05% 0.862
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-csd
Vendor Advisory
Mitigation
http://www.securitytracker.com/id/1032140
Third Party Advisory
VDB Entry