CVE-2013-1214

The scripts editor in Cisco Unified Contact Center Express (aka Unified CCX) does not properly manage privileges for anonymous logins, which allows remote attackers to read arbitrary scripts by visiting the scripts repository directory, aka Bug ID CSCuf77546.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214	Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:cisco:unified_contact_center_express_editor_software:-:*:*:*:*:*:*:*

cpe:2.3:a:cisco:unified_contact_center_express_editor_software:-:*:*:*:*:*:*:*

History

21 Nov 2024, 01:49

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214 - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214 - Vendor Advisory

Information

Published : 2013-04-24 10:28

Updated : 2024-11-21 01:49

NVD link : CVE-2013-1214

Mitre link : CVE-2013-1214

CVE.ORG link : CVE-2013-1214

JSON object : View

Products Affected

cisco

unified_contact_center_express_editor_software

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-1214", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-04-24T10:28:37.917", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1214", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The scripts editor in Cisco Unified Contact Center Express (aka Unified CCX) does not properly manage privileges for anonymous logins, which allows remote attackers to read arbitrary scripts by visiting the scripts repository directory, aka Bug ID CSCuf77546."}, {"lang": "es", "value": "El editor de secuencias de comandos de Cisco Unified Contact Center Express (tambi\u00e9n conocido como Unified CCX) no maneja adecuadamente los privilegios para los inicios de sesi\u00f3n an\u00f3nimos, lo que permite a atacantes remotos leer scripts arbitrarios visitando el directorio del repositorio de scripts, tambi\u00e9n conocido como Bug ID CSCuf77546."}], "lastModified": "2024-11-21T01:49:07.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_contact_center_express_editor_software:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14E9EB78-63EF-44CC-842B-1252E2807597"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_contact_center_express_editor_software:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14E9EB78-63EF-44CC-842B-1252E2807597"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}