CVE-2013-6709

The registration component in Cisco WebEx Training Center provides the training-session URL before payment is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul57111.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6709	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32153	Vendor Advisory
http://www.securitytracker.com/id/1029492	Third Party Advisory VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6709	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32153	Vendor Advisory
http://www.securitytracker.com/id/1029492	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:webex_training_center:-:*:*:*:*:*:*:*

History

21 Nov 2024, 01:59

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6709 - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6709 - Vendor Advisory
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=32153 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=32153 - Vendor Advisory
References	~~() http://www.securitytracker.com/id/1029492 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1029492 - Third Party Advisory, VDB Entry

Information

Published : 2013-12-14 22:55

Updated : 2024-11-21 01:59

NVD link : CVE-2013-6709

Mitre link : CVE-2013-6709

CVE.ORG link : CVE-2013-6709

JSON object : View

Products Affected

cisco

webex_training_center

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2013-6709", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-12-14T22:55:03.597", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6709", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32153", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1029492", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6709", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32153", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1029492", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The registration component in Cisco WebEx Training Center provides the training-session URL before payment is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul57111."}, {"lang": "es", "value": "El componente de registro en Cisco WebEx Training Center proporciona la URL de capacitaci\u00f3n de sesi\u00f3n antes de que se complete el pago, que permite a atacantes remotos evitar las restricciones de acceso previstos y unirse a una conferencia de audio mediante la introducci\u00f3n de campos de credenciales de esta URL, tambi\u00e9n conocido como Bug ID CSCul57111."}], "lastModified": "2024-11-21T01:59:35.670", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_training_center:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D11FA31-28A2-47C6-9030-97A250951899"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}