{"api_version":"1","generated_at":"2026-07-23T06:18:06+00:00","cve":"CVE-2014-0678","urls":{"html":"https://cve.report/CVE-2014-0678","api":"https://cve.report/api/cve/CVE-2014-0678.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-0678","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0678"},"summary":{"title":"CVE-2014-0678","description":"The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.","state":"PUBLISHED","assigner":"cisco","published_at":"2014-01-25 22:55:03","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/56540","name":"http://secunia.com/advisories/56540","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA56540 - Cisco Secure Access Control System (ACS) Portal Session Management Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Security Notice: Cisco Secure ACS Portal Session Management Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90732","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90732","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/102558","name":"http://osvdb.org/102558","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32567","name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32567","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Alert Details - Security Center - Cisco Systems","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/65144","name":"http://www.securityfocus.com/bid/65144","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Secure Access Control System Portal Interface Access Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1029688","name":"http://www.securitytracker.com/id/1029688","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Secure Access Control System Portal Lets Remote Authenticated Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0678","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0678","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"678","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"secure_access_control_system","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2014","cve_id":"678","cve":"CVE-2014-0678","epss":"0.003810000","percentile":"0.595380000","score_date":"2026-05-03","updated_at":"2026-05-04 00:13:06"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:27:18.629Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"56540","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/56540"},{"name":"65144","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/65144"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32567"},{"name":"1029688","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1029688"},{"name":"cisco-acs-cve20140678-unauth-access(90732)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90732"},{"name":"20140124 Cisco Secure ACS Portal Session Management Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678"},{"name":"102558","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/102558"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-01-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"56540","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/56540"},{"name":"65144","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/65144"},{"tags":["x_refsource_CONFIRM"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32567"},{"name":"1029688","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1029688"},{"name":"cisco-acs-cve20140678-unauth-access(90732)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90732"},{"name":"20140124 Cisco Secure ACS Portal Session Management Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678"},{"name":"102558","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/102558"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2014-0678","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"56540","refsource":"SECUNIA","url":"http://secunia.com/advisories/56540"},{"name":"65144","refsource":"BID","url":"http://www.securityfocus.com/bid/65144"},{"name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32567","refsource":"CONFIRM","url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=32567"},{"name":"1029688","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1029688"},{"name":"cisco-acs-cve20140678-unauth-access(90732)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90732"},{"name":"20140124 Cisco Secure ACS Portal Session Management Vulnerability","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0678"},{"name":"102558","refsource":"OSVDB","url":"http://osvdb.org/102558"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2014-0678","datePublished":"2014-01-25T22:00:00.000Z","dateReserved":"2014-01-02T00:00:00.000Z","dateUpdated":"2024-08-06T09:27:18.629Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-01-25 22:55:03","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:N","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:secure_access_control_system:-:*:*:*:*:*:*:*","matchCriteriaId":"716A2EC7-4A03-4BB9-B787-6DD285E25056"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"678","Ordinal":"1","Title":"CVE-2014-0678","CVE":"CVE-2014-0678","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"678","Ordinal":"1","NoteData":"The portal interface in Cisco Secure Access Control System (ACS) does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951.","Type":"Description","Title":"CVE-2014-0678"},{"CveYear":"2014","CveId":"678","Ordinal":"2","NoteData":"2014-01-25","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"678","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}