CVE-2014-3297

{"id": "CVE-2014-3297", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-07-02T10:35:25.547", "references": [{"url": "http://secunia.com/advisories/58985", "source": "ykramarz@cisco.com"}, {"url": "http://secunia.com/advisories/59401", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3297", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34834", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/68308", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1030510", "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug IDs CSCui36937, CSCui37004, and CSCui36927."}, {"lang": "es", "value": "Cisco Intelligent Automation for Cloud en Cisco Cloud Portal no restringe debidamente el contenido de URLs de la acci\u00f3n MyServices, lo que permite a usuarios remotos autenticados obtener informaci\u00f3n sensible mediante la lectura de registros de (1) acceso al servidor web, (2) el Referer del servidor web o (3) el historial del navegador, tambi\u00e9n conocido como Bug IDs CSCui36937, CSCui37004, y CSCui36927."}], "lastModified": "2015-12-03T18:37:43.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:cloud_portal:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CD287F4-D184-48A5-B8F4-FE0D14AE0EBE"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}