CVE-2013-1222

The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38379.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:C/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:unified_customer_voice_portal::::::::
	cpe:2.3:a:cisco:unified_customer_voice_portal:3.0:sr1::::::
	cpe:2.3:a:cisco:unified_customer_voice_portal:3.0:sr2::::::
	cpe:2.3:a:cisco:unified_customer_voice_portal:3.6\(10\):es01::::::
	cpe:2.3:a:cisco:unified_customer_voice_portal:4.0:::::::*
	cpe:2.3:a:cisco:unified_customer_voice_portal:4.0\(2\):::::::*
	cpe:2.3:a:cisco:unified_customer_voice_portal:4.0\(2\):sr1::::::
	cpe:2.3:a:cisco:unified_customer_voice_portal:4.1:::::::*
	cpe:2.3:a:cisco:unified_customer_voice_portal:7.0:::::::*
	cpe:2.3:a:cisco:unified_customer_voice_portal:7.0\(2\):::::::*
	cpe:2.3:a:cisco:unified_customer_voice_portal:8.0\(1\):::::::*
	cpe:2.3:a:cisco:unified_customer_voice_portal:8.5\(1\):::::::*
	cpe:2.3:a:cisco:unified_customer_voice_portal:9.0:::::::*

History

No history.

Information

Published : 2013-05-09 12:31

Updated : 2023-12-10 11:16

NVD link : CVE-2013-1222

Mitre link : CVE-2013-1222

CVE.ORG link : CVE-2013-1222

JSON object : View

Products Affected

cisco

unified_customer_voice_portal

CWE

CWE-16

Configuration

{"id": "CVE-2013-1222", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-05-09T12:31:19.190", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130508-cvp", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-16"}]}], "descriptions": [{"lang": "en", "value": "The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38379."}, {"lang": "es", "value": "La caracter\u00edstica Tomcat Web Management en Cisco Unified Customer Voice Portal (CVP) Software antes de v9.0.1 ES v11 no configura correctamente los componentes Tomcat, lo que permite a atacantes remotos lanzar aplciaciones web a trav\u00e9s de peticiones modificadas (1) HTTP \u00f3 (2) HTTPS, tambi\u00e9n conocido como Bug ID CSCub38379."}], "lastModified": "2013-05-09T13:54:51.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2658963-C679-43C8-9A39-AC84F5EEE343", "versionEndIncluding": "9.0\\(1\\)"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:3.0:sr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3FA84E2-8B3B-4C19-B135-535E58DF3847"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:3.0:sr2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44B2F5F0-DD35-463C-B73C-00B7911BCDD5"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:3.6\\(10\\):es01:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36E1A7F5-4BA6-4C10-A85B-BB666C457BFC"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B1D46F0-DEC9-418B-8973-6EC44201B0B8"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:4.0\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE565A29-2DC7-4F4F-8E47-CB404E0AA5AF"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:4.0\\(2\\):sr1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C54FFF1F-2991-46EA-90C9-319F47663699"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "270E39D1-6F71-4C6F-AE91-B0A86057CCCF"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6796545D-C15C-4ADA-8491-31FC26560809"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:7.0\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9E51515-7E70-4199-8C99-D45F21D989B2"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:8.0\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8805E471-95E0-45DF-A346-15F10EB281B4"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:8.5\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6435E484-D475-49C6-8649-7BBD3728B08F"}, {"criteria": "cpe:2.3:a:cisco:unified_customer_voice_portal:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D6A6517-6F93-4B4B-91CB-9777EBAFF922"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}