PT-2011-4384 · Cisco · Ciscoworks Voice Manager+6

Published 2011-10-20 · Updated 2017-08-29 · CVE-2011-3310

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CiscoWorks Common Services versions prior to 4.1

Description The issue allows remote authenticated users to execute arbitrary commands via a crafted URL. This affects various Cisco products that utilize CiscoWorks Common Services, including CiscoWorks LAN Management Solution, Cisco Security Manager, Cisco Unified Service Monitor, Cisco Unified Operations Manager, CiscoWorks QoS Policy Manager, and CiscoWorks Voice Manager.

Recommendations For versions prior to 4.1, update to version 4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Home Page component to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-3310

Affected Products

Cisco Security Manager

Cisco Unified Operations Manager

Cisco Unified Service Monitor

Ciscoworks Common Services

Ciscoworks Lan Management Solution

Ciscoworks Qos Policy Manager

Ciscoworks Voice Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-3310 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111019-cs · Vendor Advisory
• http://securityfocus.com/bid/50284 · Note
• http://secunia.com/advisories/46533 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70759 · Note