Role-Based Access Control Bypass in Cisco Secure Access Control Server

CVE-2015-6347

Summary

The Solution Engine in Cisco Secure Access Control Server version 5.7(0.15) has a security flaw that permits remote authenticated users to circumvent established Role-Based Access Control (RBAC) policies. This exploitation allows users to access unauthorized functionalities, including the ability to create a dashboard or portlet, by navigating to a specific web page. As a result, critical system management operations could be compromised, leading to potential unauthorized access and manipulation of sensitive data.

References