PT-2011-4384 · Cisco · Ciscoworks Voice Manager+6

Publicado 2011-10-20 · Atualizado 2017-08-29 · CVE-2011-3310

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CiscoWorks Common Services versions prior to 4.1

Description The issue allows remote authenticated users to execute arbitrary commands via a crafted URL. This affects various Cisco products that utilize CiscoWorks Common Services, including CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager.

Recommendations For versions prior to 4.1, update to version 4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Home Page component to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-3310

Produtos afetados

Cisco Security Manager

Cisco Unified Operations Manager

Cisco Unified Service Monitor

Ciscoworks Common Services

Ciscoworks Lan Management Solution

Ciscoworks Qos Policy Manager

Ciscoworks Voice Manager

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-3310 · Nota de Segurança
• http://securityfocus.com/bid/50284 · Nota
• http://secunia.com/advisories/46533 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70759 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-cs · Aviso do Fabricante