CVE-2014-3297

Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug IDs CSCui36937, CSCui37004, and CSCui36927.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/58985
http://secunia.com/advisories/59401
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3297	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34834	Vendor Advisory
http://www.securityfocus.com/bid/68308
http://www.securitytracker.com/id/1030510

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:cloud_portal:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2014-07-02 10:35

Updated : 2024-02-04 18:35

NVD link : CVE-2014-3297

Mitre link : CVE-2014-3297

CVE.ORG link : CVE-2014-3297

JSON object : View

Products Affected

cisco

cloud_portal

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-3297", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-07-02T10:35:25.547", "references": [{"url": "http://secunia.com/advisories/58985", "source": "ykramarz@cisco.com"}, {"url": "http://secunia.com/advisories/59401", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3297", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34834", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/68308", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1030510", "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug IDs CSCui36937, CSCui37004, and CSCui36927."}, {"lang": "es", "value": "Cisco Intelligent Automation for Cloud en Cisco Cloud Portal no restringe debidamente el contenido de URLs de la acci\u00f3n MyServices, lo que permite a usuarios remotos autenticados obtener informaci\u00f3n sensible mediante la lectura de registros de (1) acceso al servidor web, (2) el Referer del servidor web o (3) el historial del navegador, tambi\u00e9n conocido como Bug IDs CSCui36937, CSCui37004, y CSCui36927."}], "lastModified": "2015-12-03T18:37:43.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:cloud_portal:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CD287F4-D184-48A5-B8F4-FE0D14AE0EBE"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}