Cisco Unity Express CVE-2013-1120 Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	57678
Class:	Input Validation Error
CVE:	CVE-2013-1120
Remote:	Yes
Local:	No
Published:	Feb 01 2013 12:00AM
Updated:	Feb 01 2013 12:00AM
Credit:	Jacob Holcomb of Independent Security Evaluators
Vulnerable:
Not Vulnerable:

Cisco Unity Express CVE-2013-1120 Multiple Cross Site Request Forgery Vulnerabilities

Cisco Unity Express is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

These issues are being tracked by Cisco Bug ID CSCue35910.

Cisco Unity Express CVE-2013-1120 Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim to visit a malicious webpage.

Cisco Unity Express CVE-2013-1120 Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Reportedly, the issue is fixed, however, Symantec has not confirmed this. Please contact the vendor for more information.

Cisco Unity Express CVE-2013-1120 Multiple Cross Site Request Forgery Vulnerabilities

References:

• Cisco Unity Express (Cisco)