Details of VAR-202007-1033

ID

VAR-202007-1033

CVE

CVE-2020-3402

TITLE

Cisco Unified Customer Voice Portal Vulnerability regarding lack of authentication for critical features in

Trust: 0.8

sources: JVNDB: JVNDB-2020-007519

DESCRIPTION

A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because certain RMI listeners are not properly authenticated. An attacker could exploit this vulnerability by sending a crafted request to the affected listener. A successful exploit could allow the attacker to access sensitive information on an affected device

Trust: 1.71

sources: NVD: CVE-2020-3402 // JVNDB: JVNDB-2020-007519 // VULHUB: VHN-181527

AFFECTED PRODUCTS

vendor:	cisco	model:	unified customer voice portal	scope:	lte	version:	12.5\(1\)	Trust: 1.0
vendor:	cisco	model:	unified customer voice portal	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-007519 // NVD: CVE-2020-3402

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-3402
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2020-3402
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2020-007519
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202007-088
value:	HIGH
Trust: 0.6
VULHUB:	VHN-181527
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-3402
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-007519
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-181527
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-3402
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2020-3402
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.0
Trust: 1.0
NVD:	JVNDB-2020-007519
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-181527 // JVNDB: JVNDB-2020-007519 // CNNVD: CNNVD-202007-088 // NVD: CVE-2020-3402 // NVD: CVE-2020-3402

PROBLEMTYPE DATA

problemtype:

CWE-306

Trust: 1.9

sources: VULHUB: VHN-181527 // JVNDB: JVNDB-2020-007519 // NVD: CVE-2020-3402

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202007-088

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202007-088

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-007519

PATCH

title:

cisco-sa-cvp-info-dislosure-NZBEwj9V

url:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvp-info-dislosure-NZBEwj9V

Trust: 0.8

sources: JVNDB: JVNDB-2020-007519

EXTERNAL IDS

db:	NVD	id:	CVE-2020-3402	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-007519	Trust: 0.8
db:	CNNVD	id:	CNNVD-202007-088	Trust: 0.7
db:	AUSCERT	id:	ESB-2020.2274.2	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2274	Trust: 0.6
db:	NSFOCUS	id:	47069	Trust: 0.6
db:	VULHUB	id:	VHN-181527	Trust: 0.1

sources: VULHUB: VHN-181527 // JVNDB: JVNDB-2020-007519 // CNNVD: CNNVD-202007-088 // NVD: CVE-2020-3402

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-cvp-info-dislosure-nzbewj9v	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2020-3402	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3402	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.2274.2/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2274/	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/47069	Trust: 0.6

sources: VULHUB: VHN-181527 // JVNDB: JVNDB-2020-007519 // CNNVD: CNNVD-202007-088 // NVD: CVE-2020-3402

SOURCES

db:	VULHUB	id:	VHN-181527
db:	JVNDB	id:	JVNDB-2020-007519
db:	CNNVD	id:	CNNVD-202007-088
db:	NVD	id:	CVE-2020-3402

LAST UPDATE DATE

2024-11-23T22:55:06.427000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-181527	date:	2020-07-09T00:00:00
db:	JVNDB	id:	JVNDB-2020-007519	date:	2020-08-14T00:00:00
db:	CNNVD	id:	CNNVD-202007-088	date:	2020-08-13T00:00:00
db:	NVD	id:	CVE-2020-3402	date:	2024-11-21T05:30:57.643

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-181527	date:	2020-07-02T00:00:00
db:	JVNDB	id:	JVNDB-2020-007519	date:	2020-08-14T00:00:00
db:	CNNVD	id:	CNNVD-202007-088	date:	2020-07-01T00:00:00
db:	NVD	id:	CVE-2020-3402	date:	2020-07-02T05:15:11.697