BID:59740

Cisco Unified Customer Voice Portal CVE-2013-1222 Security Bypass Vulnerability

Info

Cisco Unified Customer Voice Portal CVE-2013-1222 Security Bypass Vulnerability

Bugtraq ID:	59740
Class:	Design Error
CVE:	CVE-2013-1222
Remote:	Yes
Local:	No
Published:	May 08 2013 12:00AM
Updated:	May 08 2013 12:00AM
Credit:	Alex Senkevitch
Vulnerable:	Cisco Unified Customer Voice Portal (CVP) 7.0(1) Cisco Unified Customer Voice Portal (CVP) 7.0 Cisco Unified Customer Voice Portal (CVP) 4.1(1)_ES11 Cisco Unified Customer Voice Portal (CVP) 4.1 Cisco Unified Customer Voice Portal (CVP) 4.0(2)_ES14 Cisco Unified Customer Voice Portal (CVP) 4.0

Not Vulnerable:

Discussion

Cisco Unified Customer Voice Portal CVE-2013-1222 Security Bypass Vulnerability

Cisco Unified Customer Voice Portal is prone to a security-bypass vulnerability.

Exploiting this issue could allow an attacker to bypass certain security restrictions and gain unauthorized access to the affected device.

This issue is being tracked by Cisco Bug ID CSCub38379.

Versions prior to Unified Customer Voice Portal (CVP) 9.0.1 ES 11 are vulnerable.

Exploit / POC

Cisco Unified Customer Voice Portal CVE-2013-1222 Security Bypass Vulnerability

An attacker can exploit this issue using a web browser.

Solution / Fix

Cisco Unified Customer Voice Portal CVE-2013-1222 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

References

Cisco Unified Customer Voice Portal CVE-2013-1222 Security Bypass Vulnerability

References:

Cisco Unified Customer Voice Portal Product Page (Cisco)