CVE-2013-3407

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The web interface in Cisco Server Provisioner 6.4.0 Patch 5-1301292331 and earlier does not require authentication for unspecified pages, which allows remote attackers to obtain sensitive information via a direct request, aka Bug ID CSCug65664.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3407Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=31776Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3407Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=31776Vendor Advisory

Timeline

Published: Nov 18, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-34086.8The firmware on Cisco Virtualization Experience Client 6000 devices sets incorrect operating-system permissions, which allows local users to CVE-2013-34094.3The portal in Cisco Prime Central for Hosted Collaboration Solution (HCS) places cleartext credentials in temporary files, which allows loca CVE-2013-34107.8Cisco Intrusion Prevention System (IPS) Software on IPS NME devices before 7.0(9)E4 allows remote attackers to cause a denial of service (de CVE-2013-34117.8The IDSM-2 drivers in Cisco Intrusion Prevention System (IPS) Software on Cisco Catalyst 6500 devices with an IDSM-2 module allow remote att CVE-2013-34126.5SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(2) allows remote authenticated users to execut CVE-2013-34134.3Cross-site scripting (XSS) vulnerability in the search form in the administration/monitoring panel on the Cisco Identity Services Engine (IS CVE-2013-34144.3Cross-site scripting (XSS) vulnerability in the WebVPN portal login page on Cisco Adaptive Security Appliances (ASA) devices allows remote a CVE-2013-34157.8Cisco Adaptive Security Appliance (ASA) Software 8.4.x before 8.4(3) and 8.6.x before 8.6(1.3) does not properly manage memory upon an AnyCo CVE-2013-34164.3Cross-site scripting (XSS) vulnerability in the web framework in the unified-communications management implementation in Cisco Unified Opera CVE-2013-34175.0The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remot CVE-2013-34186.8Cisco Unified Communications Domain Manager does not properly allocate memory for GET and POST requests, which allows remote authenticated u CVE-2013-34194.3Cross-site scripting (XSS) vulnerability in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to inject arbitrary web scri