Cisco Cisco Firepower Management Center
At a glance
- Source
- NVD
- EPSS
- EPSS 0.73 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Modified
Description
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to missing authorization for certain resources in the web-based management interface together with insufficient entropy in these resource names. An attacker could exploit this vulnerability by sending a series of HTTPS requests to an affected device to enumerate resources on the device. A successful exploit could allow the attacker to retrieve sensitive information from the device.
Weaknesses (CWE)
- CWE-334 — Small Space of Random Values
- CWE-331 — Insufficient Entropy
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | cisco |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-26191
- GCVE · GCVE-0-2022-20941
Affected configurations (NVD CPE)
cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0.6:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.1.0.7:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.0.6:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.2.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.2.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.2.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.2.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.2.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.5:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.6:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.7:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.8:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.9:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.10:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.11:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.12:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.13:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.14:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.15:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.16:*:*:*:*:*:*:*cpe:2.3:a:cisco:secure_firewall_management_center:6.2.3.17:*:*:*:*:*:*:*- +53 more
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco Firepower Management Center | affected 6.2.3 ; affected 6.2.3.1 ; affected 6.2.3.2 ; affected 6.2.3.3 ; affected 6.2.3.4 ; affected 6.2.3.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |