CVE-2013-6965

The registration component in Cisco WebEx Training Center provides the training-session URL before e-mail confirmation is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul36183.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://osvdb.org/100911
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6965	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=32157	Vendor Advisory
http://www.securityfocus.com/bid/64281
http://www.securitytracker.com/id/1029492	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/89691

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:webex_training_center:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-12-14 22:55

Updated : 2017-11-29 02:29

NVD link : CVE-2013-6965

Mitre link : CVE-2013-6965

CVE.ORG link : CVE-2013-6965

JSON object : View

Products Affected

cisco

webex_training_center

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-6965", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-12-14T22:55:14.410", "references": [{"url": "http://osvdb.org/100911", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6965", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32157", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/64281", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1029492", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89691", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The registration component in Cisco WebEx Training Center provides the training-session URL before e-mail confirmation is completed, which allows remote attackers to bypass intended access restrictions and join an audio conference by entering credential fields from this URL, aka Bug ID CSCul36183."}, {"lang": "es", "value": "El componente de registro en Cisco WebEx Training Center proporciona la URL de sesi\u00f3n antes de que se complete la confirmaci\u00f3n por e-mail, lo que permite a atacantes remotos evitar las restricciones de acceso previstos y unirse a una conferencia de audio mediante la introducci\u00f3n de campos de credenciales de esta URL, tambi\u00e9n conocido como Bug ID CSCul36183."}], "lastModified": "2017-11-29T02:29:06.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_training_center:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D11FA31-28A2-47C6-9030-97A250951899"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}