CVE-2013-1120

Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:cisco:unity_express_software::::::::
	cpe:2.3:a:cisco:unity_express_software:1.1.1:::::::*
	cpe:2.3:a:cisco:unity_express_software:1.1.2:::::::*
	cpe:2.3:a:cisco:unity_express_software:2.0:::::::*
	cpe:2.3:a:cisco:unity_express_software:2.1:::::::*
	cpe:2.3:a:cisco:unity_express_software:2.2:::::::*
	cpe:2.3:a:cisco:unity_express_software:2.3:::::::*
	cpe:2.3:a:cisco:unity_express_software:3.0:::::::*
	cpe:2.3:a:cisco:unity_express_software:3.1:::::::*
	cpe:2.3:a:cisco:unity_express_software:3.2:::::::*
	cpe:2.3:a:cisco:unity_express_software:7.0:::::::*
	cpe:2.3:a:cisco:unity_express_software:7.1:::::::*
	cpe:2.3:a:cisco:unity_express_software:7.2:::::::*
	cpe:2.3:a:cisco:unity_express_software:7.3:::::::*

cpe:2.3:h:cisco:unity_express:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-02-06 12:05

Updated : 2024-02-28 12:00

NVD link : CVE-2013-1120

Mitre link : CVE-2013-1120

CVE.ORG link : CVE-2013-1120

JSON object : View

Products Affected

cisco

unity_express_software
unity_express

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2013-1120", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-02-06T12:05:43.833", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en Cisco Unity Express con software anterior a v8.0 permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios mediante vectores desconocidos. Bug ID CSCue35910."}], "lastModified": "2013-02-07T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unity_express_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83721592-B28F-4CB5-9E0B-A9E96573DC38", "versionEndIncluding": "7.4"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05328FC0-D20B-44AD-A72B-19D125553067"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A700B4B-49E6-4F98-8094-ED6FB7841A21"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CC3A8B0-179F-4B87-857A-D13701939249"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17ECC993-69F5-43A6-AE9C-7ED2C33F56B6"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F42A5CA-B20F-45B2-A5B2-3FFDEFE7CBD5"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7594535-B2F5-44A1-B643-B34AE4570607"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F6DA8D8-803A-4F76-83A0-D10D24192306"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3938819-EB36-4404-99D3-851061479D51"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4C327C5-F673-4630-84AE-E0D583E235C4"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D82C2B8A-7CD6-4F4D-BF1C-A0D48B069D48"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23AC34EA-3AB3-4BBD-9AF1-F00925957F83"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C9B3369-DA45-4619-B965-0FC87725239B"}, {"criteria": "cpe:2.3:a:cisco:unity_express_software:7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBFE2A66-F021-403F-9DA7-D5FB2F24D406"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:unity_express:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7583D706-3702-4571-BD2C-527E5337F6E1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}