CVE-2015-4288

Name: CVE-2015-4288
Creator: NVD / NIST
Published: 2015-07-29T01:59:06.89+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.48%

Last modified Jun 17, 2026

CVE-2015-4288 is a vulnerability of currently unknown severity. The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.. EPSS estimates a 0.48% chance of exploitation in the next 30 days.

Description

The LDAP implementation on the Cisco Web Security Appliance (WSA) 8.5.0-000, Email Security Appliance (ESA) 8.5.7-042, and Content Security Management Appliance (SMA) 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCuo29561, CSCuv40466, and CSCuv40470.

Metrics

EPSS Probability

0.48%

37.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-310

Affected Software

Vendor	Product	Versions
Cisco	Web Security Appliance	8.5.0-000
Cisco	Email Security Appliance	8.5.7-042
Cisco	Content Security Management Appliance	8.3.6-048

References

http://tools.cisco.com/security/center/viewAlert.x?alertId=40137Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=40137Vendor Advisory

Timeline

Published: Jul 29, 2015
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2015-4288?

How severe is CVE-2015-4288?

Severity scoring for CVE-2015-4288 is pending analysis. The EPSS model estimates a 0.48% probability of exploitation in the next 30 days.

How do I fix CVE-2015-4288?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-4288?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST