CVE-2013-3407

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The web interface in Cisco Server Provisioner 6.4.0 Patch 5-1301292331 and earlier does not require authentication for unspecified pages, which allows remote attackers to obtain sensitive information via a direct request, aka Bug ID CSCug65664.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-34086.8The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users toCVE-2013-34094.3The portal in Cisco Prime Central for Hosted Collaboration Solution (HCS) places cleartext credentials in temporary files, which allows locaCVE-2013-34107.8Cisco Intrusion Prevention System (IPS) Software on IPS NME devices before 7.0(9)E4 allows remote attackers to cause a denial of service (deCVE-2013-34117.8The IDSM-2 drivers in Cisco Intrusion Prevention System (IPS) Software on Cisco Catalyst 6500 devices with an IDSM-2 module allow remote attCVE-2013-34126.5SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to executCVE-2013-34134.3Cross-site scripting (XSS) vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine (ISCVE-2013-34144.3Cross-site scripting (XSS) vulnerability in the WebVPN portal login page on Cisco Adaptive Security Appliances (ASA) devices allows remote aCVE-2013-34157.8Cisco Adaptive Security Appliance (ASA) Software 8.4.x before 8.4(3) and 8.6.x before 8.6(1.3) does not properly manage memory upon an AnyCoCVE-2013-34164.3Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified OperaCVE-2013-34175.0The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remotCVE-2013-34186.8Cisco Unified Communications Domain Manager does not properly allocate memory for GET and POST requests, which allows remote authenticated uCVE-2013-34194.3Cross-site scripting (XSS) vulnerability in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to inject arbitrary web scri
CVE-2013-3407: Medium severity, CVSS 5.0 | Vulnix