CVE-2013-3424

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in Administration and View pages in Cisco Secure Access Control System (ACS) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCud75177.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 12, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-34254.0The Meeting Center component in Cisco WebEx 11 generates different error messages for invalid file-access attempts depending on whether a fiCVE-2013-34265.0The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files bCVE-2013-34284.0The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authenCVE-2013-34297.8Multiple directory traversal vulnerabilities in Cisco Video Surveillance Manager (VSM) before 7.0.0 allow remote attackers to read system fiCVE-2013-34309.0Cisco Video Surveillance Manager (VSM) before 7.0.0 allows remote attackers to obtain sensitive configuration, archive, and log information CVE-2013-34317.8Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remoteCVE-2013-34336.8Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privileCVE-2013-34346.8Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privileCVE-2013-34355.0The Cisco Unified IP Conference Station 7937G allows remote attackers to cause a denial of service (networking outage) via a flood of TCP paCVE-2013-34365.0The default configuration of the Group Encrypted Transport VPN (GET VPN) feature on Cisco IOS uses an improper mechanism for enabling Group CVE-2013-34376.5SQL injection vulnerability in the management application in Cisco Unified Operations Manager allows remote authenticated users to execute aCVE-2013-34385.0The web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to bypass intended access restriction