Details of VAR-201401-0154

ID

VAR-201401-0154

CVE

CVE-2013-6687

TITLE

Cisco WebEx Meetings Server Vulnerabilities in obtaining plaintext administrator passwords

Trust: 0.8

sources: JVNDB: JVNDB-2014-001188

DESCRIPTION

The web portal in the Enterprise License Manager component in Cisco WebEx Meetings Server allows remote authenticated users to discover the cleartext administrative password by reading HTML source code, aka Bug ID CSCul33876. Cisco WebEx meetings server is prone to a password disclosure vulnerability. Successful exploits may allow an attacker to disclose sensitive information such as stored passwords; this may aid in further attacks. This issue is being tracked by Cisco bug ID CSCul33876. Cisco WebEx Meetings Server (CWMS) is a set of multi-functional conference solutions including audio, video and Web conference in Cisco's WebEx conference solution

Trust: 1.98

sources: NVD: CVE-2013-6687 // JVNDB: JVNDB-2014-001188 // BID: 64980 // VULHUB: VHN-66689

AFFECTED PRODUCTS

vendor:	cisco	model:	webex meetings server	scope:	eq	version:	-	Trust: 1.6
vendor:	cisco	model:	webex meetings server	scope:	lte	version:	1.5(.1.131)	Trust: 0.8

sources: JVNDB: JVNDB-2014-001188 // CNNVD: CNNVD-201401-347 // NVD: CVE-2013-6687

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-6687
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2013-6687
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201401-347
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-66689
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2013-6687
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-66689
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-66689 // JVNDB: JVNDB-2014-001188 // CNNVD: CNNVD-201401-347 // NVD: CVE-2013-6687

PROBLEMTYPE DATA

problemtype:

CWE-255

Trust: 1.9

sources: VULHUB: VHN-66689 // JVNDB: JVNDB-2014-001188 // NVD: CVE-2013-6687

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201401-347

TYPE

trust management

Trust: 0.6

sources: CNNVD: CNNVD-201401-347

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-001188

PATCH

title:	Cisco WebEx Meetings Server Enterprise License Manager Administrative Password Disclosure Vulnerability	url:	http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6687	Trust: 0.8
title:	32467	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=32467	Trust: 0.8

sources: JVNDB: JVNDB-2014-001188

EXTERNAL IDS

db:	NVD	id:	CVE-2013-6687	Trust: 2.8
db:	JVNDB	id:	JVNDB-2014-001188	Trust: 0.8
db:	CNNVD	id:	CNNVD-201401-347	Trust: 0.7
db:	CISCO	id:	20140116 CISCO WEBEX MEETINGS SERVER ENTERPRISE LICENSE MANAGER ADMINISTRATIVE PASSWORD DISCLOSURE VULNERABILITY	Trust: 0.6
db:	BID	id:	64980	Trust: 0.4
db:	VULHUB	id:	VHN-66689	Trust: 0.1

sources: VULHUB: VHN-66689 // BID: 64980 // JVNDB: JVNDB-2014-001188 // CNNVD: CNNVD-201401-347 // NVD: CVE-2013-6687

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2013-6687	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-6687	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-6687	Trust: 0.8

sources: VULHUB: VHN-66689 // JVNDB: JVNDB-2014-001188 // CNNVD: CNNVD-201401-347 // NVD: CVE-2013-6687

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 64980

SOURCES

db:	VULHUB	id:	VHN-66689
db:	BID	id:	64980
db:	JVNDB	id:	JVNDB-2014-001188
db:	CNNVD	id:	CNNVD-201401-347
db:	NVD	id:	CVE-2013-6687

LAST UPDATE DATE

2024-11-23T22:46:08.631000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-66689	date:	2014-01-17T00:00:00
db:	BID	id:	64980	date:	2014-01-20T01:02:00
db:	JVNDB	id:	JVNDB-2014-001188	date:	2014-01-20T00:00:00
db:	CNNVD	id:	CNNVD-201401-347	date:	2014-01-21T00:00:00
db:	NVD	id:	CVE-2013-6687	date:	2024-11-21T01:59:33.317

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-66689	date:	2014-01-16T00:00:00
db:	BID	id:	64980	date:	2014-01-16T00:00:00
db:	JVNDB	id:	JVNDB-2014-001188	date:	2014-01-20T00:00:00
db:	CNNVD	id:	CNNVD-201401-347	date:	2014-01-21T00:00:00
db:	NVD	id:	CVE-2013-6687	date:	2014-01-16T19:55:04.560