Vulnslist

find the latest Cisco vulnerabilities

Cisco Finesse User Data in Query Vulnerability

Cisco-SA-20130812-CVE-2013-3455 · Medium · Published · Updated

A vulnerability in HTTP queries of Cisco Finesse could allow an unauthenticated, remote attacker to collect potentially sensitive user data. The vulnerability is due to insecure transmission of user data in an HTTP query. An attacker could exploit this vulnerability by capturing the HTTP query between the end user and the Finesse server. Cisco has confirmed this vulnerability in a security notice and released software updates. To exploit this vulnerability, it is likely to an attacker would need access to trusted, internal networks in which the targeted device may reside. In addition, an attacker must capture an HTTP query between the targeted user and an affected device. These requirements decrease the likelihood of a successful exploit.

Cisco advisory ·CSAF JSON

Workarounds

Administrators are advised to apply the appropriate updates.

Administrators are advised to allow only trusted users to have network access.

Administrators are advised to monitor affected systems.

CVEsCVE-2013-3455
Cisco Bug IDsCSCug16732
CVSS ScoreBase 5.0
Base 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N/E:H/RL:OF/RC:C
Product Names From Source
Cisco Finesse

CSAF Product Statuses

Product Status Source CVE Rows
Cisco Finesse known_affected cisco_csaf CVE-2013-3455 1

Related Products

Product CVE Evidence
Cisco Finesse CVE-2013-3455 Cisco OpenVuln