{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-02-21T00:00:00", "descriptions": [{"lang": "en", "value": "The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20070221 Identifying and Mitigating Exploitation of Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"name": "20070221 Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"name": "24262", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/24262"}, {"name": "1017680", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1017680"}, {"name": "22647", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/22647"}, {"name": "45245", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/45245"}, {"name": "ADV-2007-0688", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"name": "cisco-unified-ip-conference-url-auth-bypass(32623)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-1062", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20070221 Identifying and Mitigating Exploitation of Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "refsource": "CISCO", "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"name": "20070221 Cisco Unified IP Conference Station and IP Phone Vulnerabilities", "refsource": "CISCO", "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"name": "24262", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/24262"}, {"name": "1017680", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1017680"}, {"name": "22647", "refsource": "BID", "url": "http://www.securityfocus.com/bid/22647"}, {"name": "45245", "refsource": "OSVDB", "url": "http://osvdb.org/45245"}, {"name": "ADV-2007-0688", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"name": "cisco-unified-ip-conference-url-auth-bypass(32623)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-1062", "datePublished": "2007-02-22T01:00:00", "dateReserved": "2007-02-21T00:00:00", "dateUpdated": "2017-07-28T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:unified_ip_conference_station_7935_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEB9E107-A173-4570-A0EA-93D109D589A9", "versionEndIncluding": "3.2\\(15\\)", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:unified_ip_conference_station_7935:-:*:*:*:*:*:*:*", "matchCriteriaId": "85E03C0E-248B-4AFC-82BC-4A4D52F05E95", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:unified_ip_conference_station_firmware_7936:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DF009E7-9F77-443B-97F9-5F1E6EB4A04A", "versionEndIncluding": "3.3\\(12\\)", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:unified_ip_conference_station_7936:-:*:*:*:*:*:*:*", "matchCriteriaId": "09A19EA1-6199-4EEE-9457-5EC8D6AC1D63", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The Cisco Unified IP Conference Station 7935 3.2(15) and earlier, and Station 7936 3.3(12) and earlier does not properly handle administrator HTTP sessions, which allows remote attackers to bypass authentication controls via a direct URL request to the administrative HTTP interface for a limited time"}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad en el programa Unified IP Conference Station de Cisco versi\u00f3n 7935 3.2 (15) y anterior, y Station versi\u00f3n 7936 3.3 (12) y anterior, no manejan apropiadamente las sesiones HTTP del administrador, lo que permite a los atacantes remotos omitir los controles de autenticaci\u00f3n por medio de una solicitud de URL directa a la interfaz HTTP administrativa para un tiempo limitado."}], "id": "CVE-2007-1062", "lastModified": "2019-05-23T16:13:16.810", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-02-22T01:28:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://osvdb.org/45245"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/24262"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://securitytracker.com/id?1017680"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.cisco.com/warp/public/707/cisco-air-20070221-phone.shtml"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/22647"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0688"}, {"source": "cve@mitre.org", "tags": ["VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32623"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}