Vulnerability CVE-2014-3297
Published: 2014-07-02

Description:
Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug IDs CSCui36937, CSCui37004, and CSCui36927.

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Cisco -> Cloud portal 

 References:
http://www.securitytracker.com/id/1030510
http://www.securityfocus.com/bid/68308
http://tools.cisco.com/security/center/viewAlert.x?alertId=34834
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3297
Copyright 2024, cxsecurity.com

 

Back to Top