CVE-2015-4221

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext passwords, and consequently execute arbitrary commands, by visiting an unspecified web page and then conducting a decryption attack, aka Bug ID CSCuq46194.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://tools.cisco.com/security/center/viewAlert.x?alertId=39505Vendor Advisory
http://www.securityfocus.com/bid/75401Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032716Third Party Advisory, VDB Entry
http://tools.cisco.com/security/center/viewAlert.x?alertId=39505Vendor Advisory
http://www.securityfocus.com/bid/75401Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032716Third Party Advisory, VDB Entry

Timeline

Published: Jun 26, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-42226.5SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to exec CVE-2015-42235.0Cisco IOS XR 5.1.3 allows remote attackers to cause a denial of service (process reload) via crafted MPLS Label Distribution Protocol (LDP) CVE-2015-42247.2Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) allow local users to execute arbitrary OS commands in a privileged cont CVE-2015-42254.0Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC hea CVE-2015-42267.1The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol, which allows remote attacke CVE-2015-42277.8Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vector CVE-2015-42285.4Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, ak CVE-2015-42295.0The web framework in Cisco Unified Communications Domain Manager 8.1(4)ER1 allows remote attackers to obtain sensitive information by visiti CVE-2015-42307.8Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vector CVE-2015-42313.6The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an CVE-2015-42324.6Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in CVE-2015-42336.5SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via u