{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-02-21T00:00:00", "descriptions": [{"lang": "en", "value": "The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20070221 Identifying and Mitigating Exploitation of Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"name": "20070221 Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"name": "24262", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/24262"}, {"name": "1017680", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1017680"}, {"name": "22647", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/22647"}, {"name": "45245", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/45245"}, {"name": "ADV-2007-0688", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"name": "cisco-unified-ip-conference-url-auth-bypass(32623)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2007-1062", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20070221 Identifying and Mitigating Exploitation of Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "refsource": "CISCO", "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"name": "20070221 Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "refsource": "CISCO", "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"name": "24262", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/24262"}, {"name": "1017680", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1017680"}, {"name": "22647", "refsource": "BID", "url": "http://www.securityfocus.com/bid/22647"}, {"name": "45245", "refsource": "OSVDB", "url": "http://osvdb.org/45245"}, {"name": "ADV-2007-0688", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"name": "cisco-unified-ip-conference-url-auth-bypass(32623)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T12:43:22.488Z"}, "title": "CVE Program Container", "references": [{"name": "20070221 Identifying and Mitigating Exploitation of Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"name": "20070221 Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"name": "24262", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/24262"}, {"name": "1017680", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1017680"}, {"name": "22647", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/22647"}, {"name": "45245", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/45245"}, {"name": "ADV-2007-0688", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"name": "cisco-unified-ip-conference-url-auth-bypass(32623)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-1062", "datePublished": "2007-02-22T01:00:00", "dateReserved": "2007-02-21T00:00:00", "dateUpdated": "2024-08-07T12:43:22.488Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:unified_ip_conference_station_7935_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEB9E107-A173-4570-A0EA-93D109D589A9", "versionEndIncluding": "3.2\\(15\\)", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:unified_ip_conference_station_7935:-:*:*:*:*:*:*:*", "matchCriteriaId": "85E03C0E-248B-4AFC-82BC-4A4D52F05E95", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:unified_ip_conference_station_firmware_7936:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DF009E7-9F77-443B-97F9-5F1E6EB4A04A", "versionEndIncluding": "3.3\\(12\\)", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:unified_ip_conference_station_7936:-:*:*:*:*:*:*:*", "matchCriteriaId": "09A19EA1-6199-4EEE-9457-5EC8D6AC1D63", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time"}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad en el programa Unified IP Conference Station de Cisco versi\u00f3n 7935 3.2 (15) y anterior, y Station versi\u00f3n 7936 3.3 (12) y anterior, no manejan apropiadamente las sesiones HTTP del administrador, lo que permite a los atacantes remotos omitir los controles de autenticaci\u00f3n por medio de una solicitud de URL directa a la interfaz HTTP administrativa para un tiempo limitado."}], "id": "CVE-2007-1062", "lastModified": "2024-11-21T00:27:24.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-02-22T01:28:00.000", "references": [{"source": "[email protected]", "tags": ["Broken Link"], "url": "http://osvdb.org/45245"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/24262"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://securitytracker.com/id?1017680"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/22647"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"source": "[email protected]", "tags": ["VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://osvdb.org/45245"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/24262"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://securitytracker.com/id?1017680"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/22647"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "[email protected]", "type": "Primary"}]}

{}