CVE-2005-2631

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Cisco Clean Access (CCA) 3.3.0 to 3.3.9, 3.4.0 to 3.4.5, and 3.5.0 to 3.5.3 does not properly authenticate users when invoking API methods, which could allow remote attackers to bypass security checks, change the assigned role of a user, or disconnect users.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/16472/Patch, Vendor Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20050817-cca.shtmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/14585Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21884
http://secunia.com/advisories/16472/Patch, Vendor Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20050817-cca.shtmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/14585Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21884

Timeline

Published: Aug 23, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-26327.5SQL injection vulnerability in login_admin_mediabox404.php in mediabox404 1.2 and earlier allows remote attackers to execute arbitrary SQL c CVE-2005-26337.5Multiple PHP file inclusion vulnerabilities in (1) admin_o.php, (2) board_o.php, (3) dev_o.php, (4) file_o.php or (5) tech_o.php in PHPTB To CVE-2005-26347.5Buffer overflow in the Log-SCR function in the "Log to Screen" feature in WinFtp Server 1.6.8 allows remote attackers to cause a denial of s CVE-2005-26355.0Multiple directory traversal vulnerabilities in phpAdsNew and phpPgAds before 2.0.6 allow remote attackers to include arbitrary files via a CVE-2005-26367.5SQL injection vulnerability in lib-view-direct.inc.php in phpAdsNew and phpPgAds before 2.0.6 allows remote attackers to execute arbitrary S CVE-2005-26377.5Multiple SQL injection vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) CVE-2005-26384.3Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeNews 1.40 and earlier allow remote attackers to inject arbitrary web script or CVE-2005-26397.5Buffer overflow in Chris Moneymaker's World Poker Championship 1.0 allows remote attackers to cause a denial of service (application crash) CVE-2005-26405.0Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key auth CVE-2005-26417.5Unknown vulnerability in pam_ldap before 180 does not properly handle a new password policy control, which could allow attackers to gain pri CVE-2005-26427.5Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt 1.5.10 allows remote attackers to execute arbitrary code, possibly du CVE-2005-26435.0Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral Diffie