CVE-2017-12310

{"id": "CVE-2017-12310", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-03-27T09:29:00.217", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171023-spark", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171023-spark", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive information in the unencrypted headers of an HTTP method request. The attacker could use this information to conduct additional reconnaissance attacks leading to the disclosure of sensitive customer data. The vulnerability exists in the auto discovery phase because an unencrypted HTTP request is made due to requirements for implementing the Hybrid Calendar service. An attacker could exploit this vulnerability by monitoring the unencrypted traffic on the network. An exploit could allow the attacker to access sensitive customer data belonging to Office365 users, such as email and calendar events. Cisco Bug IDs: CSCvg35593."}, {"lang": "es", "value": "Una vulnerabilidad en la fase de descubrimiento de Cisco Spark Hybrid Calendar Service podr\u00eda permitir a un atacante remoto no autenticado visualizar informaci\u00f3n sensible en las cabeceras no cifradas de una petici\u00f3n HTTP method. El atacante podr\u00eda utilizar esta informaci\u00f3n para realizar ataques adicionales de reconocimiento que den lugar a la revelaci\u00f3n de datos sensibles de clientes. La vulnerabilidad existe en la fase de autodescubrimiento debido a que se realiza una petici\u00f3n HTTP no cifrada por requisitos de implementaci\u00f3n del servicio Hybrid Calendar. Un atacante podr\u00eda explotar esta vulnerabilidad monitorizando el tr\u00e1fico no cifrado de la red. Un exploit podr\u00eda permitir que el atacante acceda a datos sensibles de clientes que pertenecen a usuarios de Office365 como correos electr\u00f3nicos y eventos de calendario. Cisco Bug IDs: CSCvg35593."}], "lastModified": "2024-11-21T03:09:17.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:spark_hybrid_calendar_service:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55386B52-E000-4C92-B373-A07DB019D447"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}