A vulnerability was found in Cisco Unity Express Software up to 2.0. It has been rated as problematic. This issue affects an unknown part. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910.

The weakness was released 02/06/2013 as CSCue35910 as confirmed security notice (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2013-1120 since 01/11/2013. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 2.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (24449). Entry connected to this vulnerability is available at VDB-63568.

Productinfo

Vendor

• Cisco

Name

• Unity Express Software

Version

• 2.0

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion