// For flags

CVE-2015-4288

 

Severity Score

5.9
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.

Vulnerabilidad en la implementación LDAP en Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042 y Content Security Management Appliance (SMA) 8.3.6-048, no verifica los certificados X.509 de los servidores SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y obtener información sensible a través de un certificado manipulado, también conocido como Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-06-04 CVE Reserved
  • 2015-07-29 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-310: Cryptographic Issues
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
http://tools.cisco.com/security/center/viewAlert.x?alertId=40137 2015-07-29
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Web Security Appliance
Search vendor "Cisco" for product "Web Security Appliance"
 8.5.0-000
Search vendor "Cisco" for product "Web Security Appliance" and version "8.5.0-000"
-
Affected
Cisco
Search vendor "Cisco"
 Email Security Appliance
Search vendor "Cisco" for product "Email Security Appliance"
 8.5.7-042
Search vendor "Cisco" for product "Email Security Appliance" and version "8.5.7-042"
-
Affected
Cisco
Search vendor "Cisco"
 Content Security Management Appliance
Search vendor "Cisco" for product "Content Security Management Appliance"
 8.3.6-048
Search vendor "Cisco" for product "Content Security Management Appliance" and version "8.3.6-048"
-
Affected