Sign-up

ID

VAR-201302-0388


CVE

CVE-2013-1128


TITLE

Cisco Unified MeetingPlace Server cross-site request forgery vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2013-001585

DESCRIPTION

Multiple cross-site request forgery (CSRF) vulnerabilities in the server in Cisco Unified MeetingPlace before 7.1(2.2000) allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuc64903. NOTE: some of these details are obtained from third party information. The problem is Bug ID CSCuc64903 It is a problem.Authentication may be hijacked by a third party. Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible. This solution provides a user environment that integrates voice, video and Web conferencing. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Cisco Unified MeetingPlace Cross-Site Request Forgery Vulnerability SECUNIA ADVISORY ID: SA52194 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52194/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52194 RELEASE DATE: 2013-02-13 DISCUSS ADVISORY: http://secunia.com/advisories/52194/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/52194/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=52194 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Cisco Unified MeetingPlace, which can be exploited by malicious people to conduct cross-site request forgery attacks. The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to perform certain unspecified actions when a logged-in user visits a specially crafted web page. SOLUTION: Update to version 7.1(2.2000). PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1128 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2013-1128 // JVNDB: JVNDB-2013-001585 // BID: 57937 // VULHUB: VHN-61130 // PACKETSTORM: 120267

AFFECTED PRODUCTS

vendor:ciscomodel:unified meetingplacescope:eqversion:7.0

Trust: 1.6

vendor:ciscomodel:unified meetingplacescope:eqversion:6.0

Trust: 1.6

vendor:ciscomodel:unified meetingplacescope:eqversion:6.1

Trust: 1.6

vendor:ciscomodel:unified meetingplacescope:eqversion:5.4

Trust: 1.6

vendor:ciscomodel:unified meetingplacescope:eqversion:7.0.3

Trust: 1.6

vendor:ciscomodel:unified meetingplacescope:eqversion:7.0.1

Trust: 1.6

vendor:ciscomodel:unified meetingplacescope:eqversion:7.0.2

Trust: 1.6

vendor:ciscomodel:unified meetingplacescope:lteversion:7.1

Trust: 1.0

vendor:ciscomodel:unified meetingplacescope:eqversion:7.1

Trust: 0.9

vendor:ciscomodel:unified meetingplacescope:ltversion:7.1

Trust: 0.8

vendor:ciscomodel:unified meetingplacescope:neversion:7.1(2.2000)

Trust: 0.3

sources: BID: 57937 // JVNDB: JVNDB-2013-001585 // CNNVD: CNNVD-201302-272 // NVD: CVE-2013-1128

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-1128
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-1128
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201302-272
value: MEDIUM

Trust: 0.6

VULHUB: VHN-61130
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-1128
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-61130
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-61130 // JVNDB: JVNDB-2013-001585 // CNNVD: CNNVD-201302-272 // NVD: CVE-2013-1128

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-61130 // JVNDB: JVNDB-2013-001585 // NVD: CVE-2013-1128

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201302-272

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201302-272

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-001585

PATCH
title:Cisco Unified MeetingPlace Server Cross-Site Request Forgery Vulnerabilityurl:http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1128
Trust: 0.8
title:28217url:http://tools.cisco.com/security/center/viewAlert.x?alertId=28217
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-001585

EXTERNAL IDS
db:NVDid:CVE-2013-1128
Trust: 2.9
db:SECUNIAid:52194
Trust: 1.9
db:JVNDBid:JVNDB-2013-001585
Trust: 0.8
db:CNNVDid:CNNVD-201302-272
Trust: 0.7
db:CISCOid:20130211 CISCO UNIFIED MEETINGPLACE SERVER CROSS-SITE REQUEST FORGERY VULNERABILITY
Trust: 0.6
db:BIDid:57937
Trust: 0.4
db:VULHUBid:VHN-61130
Trust: 0.1
db:PACKETSTORMid:120267
Trust: 0.1
sources:
            
            
            VULHUB: VHN-61130 // 
            
            
            
            BID: 57937 // 
            
            
            
            JVNDB: JVNDB-2013-001585 // 
            
            
            
            PACKETSTORM: 120267 // 
            
            
            
            CNNVD: CNNVD-201302-272 // 
            
            
            
            NVD: CVE-2013-1128

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2013-1128
Trust: 2.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=28217
Trust: 1.7
url:http://secunia.com/advisories/52194
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-1128
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-1128
Trust: 0.8
url:http://www.cisco.com/en/us/products/sw/ps5664/ps5669/index.html
Trust: 0.3
url:http://secunia.com/advisories/52194/
Trust: 0.1
url:http://secunia.com/advisories/52194/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=52194
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-61130 // 
            
            
            
            BID: 57937 // 
            
            
            
            JVNDB: JVNDB-2013-001585 // 
            
            
            
            PACKETSTORM: 120267 // 
            
            
            
            CNNVD: CNNVD-201302-272 // 
            
            
            
            NVD: CVE-2013-1128

CREDITS
Reported by the vendor.
Trust: 0.3
sources:
            
            
            BID: 57937

SOURCES
db:VULHUBid:VHN-61130
db:BIDid:57937
db:JVNDBid:JVNDB-2013-001585
db:PACKETSTORMid:120267
db:CNNVDid:CNNVD-201302-272
db:NVDid:CVE-2013-1128

LAST UPDATE DATE
2024-11-23T22:18:46.386000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-61130date:2013-02-18T00:00:00
db:BIDid:57937date:2013-02-11T00:00:00
db:JVNDBid:JVNDB-2013-001585date:2013-02-22T00:00:00
db:CNNVDid:CNNVD-201302-272date:2013-02-20T00:00:00
db:NVDid:CVE-2013-1128date:2024-11-21T01:48:57.400

SOURCES RELEASE DATE
db:VULHUBid:VHN-61130date:2013-02-15T00:00:00
db:BIDid:57937date:2013-02-11T00:00:00
db:JVNDBid:JVNDB-2013-001585date:2013-02-18T00:00:00
db:PACKETSTORMid:120267date:2013-02-13T11:12:53
db:CNNVDid:CNNVD-201302-272date:2013-02-20T00:00:00
db:NVDid:CVE-2013-1128date:2013-02-15T12:09:29.023