CVE-2017-12286

{"id": "CVE-2017-12286", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2017-10-19T08:29:00.497", "references": [{"url": "http://www.securityfocus.com/bid/101515", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1039625", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-jab1", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected software, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input and validation checks in the affected software. An attacker could exploit this vulnerability by authenticating locally to an affected system and then issuing specific commands to the affected software. A successful exploit could allow the attacker to view all profile information for a user instead of only certain Jabber parameters that should be visible. This vulnerability affects all releases of Cisco Jabber prior to Release 1.9.31. Cisco Bug IDs: CSCve52418."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz web de Cisco Jabber podr\u00eda permitir que un atacante local autenticado recupere informaci\u00f3n del perfil de usuario del software afectado, lo que podr\u00eda dar lugar a la revelaci\u00f3n de informaci\u00f3n confidencial. Esta vulnerabilidad se debe una la falta de comprobaciones de entradas y validaciones en el software afectado. Un atacante podr\u00eda explotar esta vulnerabilidad autentic\u00e1ndose de manera local en el sistema afectado y enviando entonces comandos espec\u00edficos al software afectado. Un exploit con \u00e9xito podr\u00eda permitir que el atacante visualizase toda la informaci\u00f3n del perfil donde solo deber\u00edan ser visibles ciertos par\u00e1metros de Jabber. Esta vulnerabilidad afecta a todas las distribuciones de Cisco Jabber anteriores a la distribuci\u00f3n 1.9.31. Cisco Bug IDs: CSCve52418."}], "lastModified": "2019-10-09T23:22:50.637", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:jabber:1.9.30:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "DFE62F58-04B1-4FA8-9C64-3E37E8CFF98C"}, {"criteria": "cpe:2.3:a:cisco:webex_meeting_center:1.9.26:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "749526DD-4A7B-4E91-979D-570AE9EFEB26"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}