CVE-2013-3473 (GCVE-0-2013-3473)

Vulnerability from cvelistv5 – Published: 2013-09-20 18:00 – Updated: 2024-09-17 01:36
VLAI?
Summary
The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://tools.cisco.com/security/center/content/Ci… vendor-advisoryx_refsource_CISCO
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:07:37.999Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20130918 Cisco Prime Central for Hosted Collaboration Solution Assurance Unauthenticated Username and Password Enumeration Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-pc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-09-20T18:00:00Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20130918 Cisco Prime Central for Hosted Collaboration Solution Assurance Unauthenticated Username and Password Enumeration Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-pc"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2013-3473",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20130918 Cisco Prime Central for Hosted Collaboration Solution Assurance Unauthenticated Username and Password Enumeration Vulnerability",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-pc"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2013-3473",
    "datePublished": "2013-09-20T18:00:00Z",
    "dateReserved": "2013-05-06T00:00:00Z",
    "dateUpdated": "2024-09-17T01:36:49.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"9.1\", \"matchCriteriaId\": \"2C7857FD-FF8A-4222-89B2-8E36D81C16A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51C22E91-188C-4927-8CBB-E242040F6AEC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:1.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2A393353-5FD1-4760-9A06-B7F8A2121B6C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:8.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BEC9F2A8-B9ED-4FBC-A678-E1017E67B096\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D59739B-0E2E-475A-971B-EE0687667A65\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600.\"}, {\"lang\": \"es\", \"value\": \"El framework de Cisco Prime Central en Hosted Collaboration Solution (HCS) Assurance anterior a la versi\\u00f3n 9.1.1 no determina adecuadamente la existencia de una sesi\\u00f3n autenticada, lo que permite a los atacantes remotos descubrir nombres de usuario y contrase\\u00f1as a trav\\u00e9s de una petici\\u00f3n HTTP, aka Bug ID CSCud32600.\"}]",
      "id": "CVE-2013-3473",
      "lastModified": "2024-11-21T01:53:41.690",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:N/A:N\", \"baseScore\": 7.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2013-09-20T18:55:09.830",
      "references": "[{\"url\": \"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-pc\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-pc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2013-3473\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2013-09-20T18:55:09.830\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600.\"},{\"lang\":\"es\",\"value\":\"El framework de Cisco Prime Central en Hosted Collaboration Solution (HCS) Assurance anterior a la versi\u00f3n 9.1.1 no determina adecuadamente la existencia de una sesi\u00f3n autenticada, lo que permite a los atacantes remotos descubrir nombres de usuario y contrase\u00f1as a trav\u00e9s de una petici\u00f3n HTTP, aka Bug ID CSCud32600.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:N/A:N\",\"baseScore\":7.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"9.1\",\"matchCriteriaId\":\"2C7857FD-FF8A-4222-89B2-8E36D81C16A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51C22E91-188C-4927-8CBB-E242040F6AEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A393353-5FD1-4760-9A06-B7F8A2121B6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:8.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEC9F2A8-B9ED-4FBC-A678-E1017E67B096\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:prime_central_for_hosted_collaboration_solution_assurance:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D59739B-0E2E-475A-971B-EE0687667A65\"}]}]}],\"references\":[{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-pc\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130918-pc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.