var-201307-0219
Vulnerability from variot
Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID CSCsv40169. Vendors have confirmed this vulnerability Bug ID CSCsv40169 It is released as.A third party may obtain important configuration, archive, and log information. Cisco Video Surveillance Manager is prone to a remote authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and gain administrative controls of the vulnerable device. This may lead to further attacks. This issue is tracked by Cisco Bug ID CSCsv40169. Versions prior to Cisco Video Surveillance Manager 7.0.0 are vulnerable. It provides a browser-based user interface for collecting, managing, recording, archiving and categorizing video from multiple third-party video encoders and IP cameras. The vulnerability comes from the fact that the program accessing the VSMC monitoring page does not require identity authentication
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201307-0219", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "video surveillance manager", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "1.2.1" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "6.3.1" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "4.2.1" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "4.2.0" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "6.3.2" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "6.3" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.1.6" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.1.2" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.1.7" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.1" }, { "model": "video surveillance manager", "scope": "lte", "trust": 1.0, "vendor": "cisco", "version": "6.3.3" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.3.0" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.1.4" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "4.0.1" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.3.1" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "1.1.0" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.0.0" }, { "model": "video surveillance manager", "scope": "eq", "trust": 1.0, "vendor": "cisco", "version": "2.1.3" }, { "model": "video surveillance manager", "scope": "lt", "trust": 0.8, "vendor": "cisco", "version": "7.0.0" }, { "model": "video surveillance manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "6.3.3" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "db": "NVD", "id": "CVE-2013-3431" }, { "db": "CNNVD", "id": "CNNVD-201307-507" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:1.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:6.3.2:mr2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "6.3.3", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:4.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:4.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:6.3.2:mr3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:1.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:6.3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:4.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:2.1.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:6.3.2:mr1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cisco:video_surveillance_manager:6.3.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2013-3431" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco", "sources": [ { "db": "BID", "id": "61431" }, { "db": "CNNVD", "id": "CNNVD-201307-507" } ], "trust": 0.9 }, "cve": "CVE-2013-3431", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 7.8, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "impactScore": 6.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 7.8, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "CVE-2013-3431", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 7.8, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "VHN-63433", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:C/I:N/A:N", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "NVD", "id": "CVE-2013-3431", "trust": 1.8, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-201307-507", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-63433", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-63433" }, { "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "db": "NVD", "id": "CVE-2013-3431" }, { "db": "CNNVD", "id": "CNNVD-201307-507" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote attackers to obtain sensitive configuration, archive, and log information via unspecified vectors, related to the Cisco_VSBWT (aka Broadware sample code) package, aka Bug ID CSCsv40169. Vendors have confirmed this vulnerability Bug ID CSCsv40169 It is released as.A third party may obtain important configuration, archive, and log information. Cisco Video Surveillance Manager is prone to a remote authentication-bypass vulnerability. \nAn attacker can exploit this issue to bypass the authentication mechanism and gain administrative controls of the vulnerable device. This may lead to further attacks. \nThis issue is tracked by Cisco Bug ID CSCsv40169. \nVersions prior to Cisco Video Surveillance Manager 7.0.0 are vulnerable. It provides a browser-based user interface for collecting, managing, recording, archiving and categorizing video from multiple third-party video encoders and IP cameras. The vulnerability comes from the fact that the program accessing the VSMC monitoring page does not require identity authentication", "sources": [ { "db": "NVD", "id": "CVE-2013-3431" }, { "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "db": "BID", "id": "61431" }, { "db": "VULHUB", "id": "VHN-63433" } ], "trust": 1.98 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://www.scap.org.cn/vuln/vhn-63433", "trust": 0.1, "type": "unknown" } ], "sources": [ { "db": "VULHUB", "id": "VHN-63433" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2013-3431", "trust": 2.8 }, { "db": "BID", "id": "61431", "trust": 2.0 }, { "db": "SECTRACK", "id": "1028827", "trust": 1.1 }, { "db": "JVNDB", "id": "JVNDB-2013-003512", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201307-507", "trust": 0.7 }, { "db": "CISCO", "id": "20130724 MULTIPLE VULNERABILITIES IN THE CISCO VIDEO SURVEILLANCE MANAGER", "trust": 0.6 }, { "db": "EXPLOIT-DB", "id": "24786", "trust": 0.1 }, { "db": "VULHUB", "id": "VHN-63433", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-63433" }, { "db": "BID", "id": "61431" }, { "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "db": "NVD", "id": "CVE-2013-3431" }, { "db": "CNNVD", "id": "CNNVD-201307-507" } ] }, "id": "VAR-201307-0219", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-63433" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T12:58:07.611000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "30093", "trust": 0.8, "url": "http://tools.cisco.com/security/center/viewambalert.x?alertid=30093" }, { "title": "cisco-sa-20130724-vsm", "trust": 0.8, "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130724-vsm" }, { "title": "30132", "trust": 0.8, "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=30132" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2013-003512" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-287", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-63433" }, { "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "db": "NVD", "id": "CVE-2013-3431" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://www.securityfocus.com/bid/61431" }, { "trust": 1.7, "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130724-vsm" }, { "trust": 1.1, "url": "http://www.securitytracker.com/id/1028827" }, { "trust": 1.1, "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/85945" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3431" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3431" }, { "trust": 0.3, "url": "http://www.cisco.com/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-63433" }, { "db": "BID", "id": "61431" }, { "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "db": "NVD", "id": "CVE-2013-3431" }, { "db": "CNNVD", "id": "CNNVD-201307-507" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-63433" }, { "db": "BID", "id": "61431" }, { "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "db": "NVD", "id": "CVE-2013-3431" }, { "db": "CNNVD", "id": "CNNVD-201307-507" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2013-07-25T00:00:00", "db": "VULHUB", "id": "VHN-63433" }, { "date": "2013-07-24T00:00:00", "db": "BID", "id": "61431" }, { "date": "2013-07-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "date": "2013-07-25T15:53:16.233000", "db": "NVD", "id": "CVE-2013-3431" }, { "date": "2013-07-25T00:00:00", "db": "CNNVD", "id": "CNNVD-201307-507" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-08-29T00:00:00", "db": "VULHUB", "id": "VHN-63433" }, { "date": "2013-07-25T06:44:00", "db": "BID", "id": "61431" }, { "date": "2013-07-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2013-003512" }, { "date": "2017-08-29T01:33:23.370000", "db": "NVD", "id": "CVE-2013-3431" }, { "date": "2013-07-26T00:00:00", "db": "CNNVD", "id": "CNNVD-201307-507" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201307-507" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco Video Surveillance Manager Vulnerabilities in which important settings, archives, and log information are obtained", "sources": [ { "db": "JVNDB", "id": "JVNDB-2013-003512" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "authorization issue", "sources": [ { "db": "CNNVD", "id": "CNNVD-201307-507" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.