PT-2007-3378 · Cisco · Cisco Wireless Control System

Published 2007-04-16 · Updated 2017-07-29 · CVE-2007-2035

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Wireless Control System (WCS) versions prior to 4.0.66.0

Description The issue allows remote attackers to obtain network organization data via a direct request for files in certain directories due to insufficient access control. This is because sensitive information is stored under the web root.

Recommendations For versions prior to 4.0.66.0, update to version 4.0.66.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories under the web root to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-2035

Affected Products

Cisco Wireless Control System

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-2035 · Security Note
• http://cisco.com/warp/public/707/cisco-sa-20070412-wcs.shtml · Vendor Advisory
• http://securitytracker.com/id?1017907 · Note
• http://securityfocus.com/bid/23460 · Note
• http://osvdb.org/34131 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33606 · Note
• http://vupen.com/english/advisories/2007/1367 · Note
• http://secunia.com/advisories/24865 · Note