CVE-2016-1392

Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuu34121.

CVSS v3 7.4 HIGH
CVSS v2.0 5.8 MEDIUM

7.4^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160503-pca	Vendor Advisory
http://www.securitytracker.com/id/1035736

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.0:::::::*
	cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.1:::::::*
	cpe:2.3:a:cisco:prime_collaboration_assurance:10.6.0:::::::*
	cpe:2.3:a:cisco:prime_collaboration_assurance:11.0.0:::::::*

History

No history.

Information

Published : 2016-05-05 21:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-1392

Mitre link : CVE-2016-1392

CVE.ORG link : CVE-2016-1392

JSON object : View

Products Affected

cisco

prime_collaboration_assurance

CWE

NVD-CWE-Other

{"id": "CVE-2016-1392", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "published": "2016-05-05T21:59:05.800", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160503-pca", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1035736", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuu34121."}, {"lang": "es", "value": "Vulnerabilidad de redirecci\u00f3n abierta en Cisco Prime Collaboration Assurance Software 10.5 hasta la versi\u00f3n 11.0 permite a atacantes remotos redirigir a usuarios a sitios web arbitrarios y llevar a cabo ataques de phising a trav\u00e9s de vectores no especificados, tambi\u00e9n conocido como Bug ID CSCuu34121."}], "lastModified": "2016-12-01T03:05:29.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24D5EE73-6543-4011-85C3-CDBB079043C2"}, {"criteria": "cpe:2.3:a:cisco:prime_collaboration_assurance:10.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7BC51A3-C6B9-43F3-B742-4925A9DFEDDC"}, {"criteria": "cpe:2.3:a:cisco:prime_collaboration_assurance:10.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF979F82-4761-45D7-A1A1-44F0B3C8CFD1"}, {"criteria": "cpe:2.3:a:cisco:prime_collaboration_assurance:11.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "869158A1-B464-4913-AC4B-D79EE02923CF"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/601.html\">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>", "sourceIdentifier": "ykramarz@cisco.com"}