Multiple Cisco Devices CVE-2013-3395 Cross Site Request Forgery Vulnerability

Bugtraq ID:	60919
Class:	Input Validation Error
CVE:	CVE-2013-3395
Remote:	Yes
Local:	No
Published:	Jul 01 2013 12:00AM
Updated:	Jul 01 2013 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Web Security Appliance 7.5.1 Cisco Web Security Appliance 7.5 Cisco Web Security Appliance 7.1.4 Cisco Web Security Appliance 7.1.3 Cisco Web Security Appliance 7.1.2 Cisco Web Security Appliance 7.1.1 Cisco Web Security Appliance 7.1 Cisco Web Security Appliance 7.7 Cisco Email Security Appliance 7.6.2 Cisco Email Security Appliance 7.6.1 Cisco Email Security Appliance 7.6 Cisco Email Security Appliance 7.5.2 Cisco Email Security Appliance 7.5.1 Cisco Email Security Appliance 7.5 Cisco Email Security Appliance 7.3.2 Cisco Email Security Appliance 7.3.1 Cisco Email Security Appliance 7.3 Cisco Email Security Appliance 7.1.5 Cisco Email Security Appliance 7.1.4 Cisco Email Security Appliance 7.1.3 Cisco Email Security Appliance 7.1.2 Cisco Email Security Appliance 7.1.1 Cisco Email Security Appliance 7.1 Cisco Email Security Appliance 7.8 Cisco Content Security Management Appliance 8.1 Cisco Content Security Management Appliance 8.0 Cisco Content Security Management Appliance 7.9.1 Cisco Content Security Management Appliance 7.9 Cisco Content Security Management Appliance 7.7.1 Cisco Content Security Management Appliance 7.7 Cisco Content Security Management Appliance 7.2.2 Cisco Content Security Management Appliance 7.2.1 Cisco Content Security Management Appliance 7.2
Not Vulnerable:

Multiple Cisco Devices CVE-2013-3395 Cross Site Request Forgery Vulnerability

Multiple Cisco Devices are prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue to perform certain administrative actions and to gain unauthorized access to the affected device.

This issue is being tracked by Cisco bug IDs CSCuh70323, CSCuh26634, and CSCuh70263.

Multiple Cisco Devices CVE-2013-3395 Cross Site Request Forgery Vulnerability

To exploit the issue an attacker must entice a user into visiting a malicious site.

Multiple Cisco Devices CVE-2013-3395 Cross Site Request Forgery Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Cisco Devices CVE-2013-3395 Cross Site Request Forgery Vulnerability

References:

• Cisco Content Filtering Devices Cross-Site Request Forgery Vulnerability (Cisco)
  
• Cisco Homepage (Cisco )
  
• Cisco IronPort Cross-Site Request Forgery Vulnerability (Cisco)