CVE-2015-0597

The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0597	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=37240	Vendor Advisory
http://www.securityfocus.com/bid/72373	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1031678	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100658

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-02-02 01:59

Updated : 2024-02-28 12:20

NVD link : CVE-2015-0597

Mitre link : CVE-2015-0597

CVE.ORG link : CVE-2015-0597

JSON object : View

Products Affected

cisco

webex_meetings_server

CWE

CWE-20

Improper Input Validation

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2015-0597", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-02-02T01:59:08.950", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0597", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=37240", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/72373", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1031678", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100658", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159."}, {"lang": "es", "value": "La caracter\u00edstica Forgot Password en Cisco WebEx Meetings Server 1.5(.1.131) y anteriores permite a atacantes remotos enumerar las cuentas administrativas a trav\u00e9s de paquetes manipulados, tambi\u00e9n conocido como Bug IDs CSCuj67166 y CSCuj67159."}], "lastModified": "2017-09-08T01:29:45.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFBF4BC9-68A8-4AF2-88C3-EDADB721B6C8", "versionEndIncluding": "1.5\\(.1.131\\)"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}