CVE-2013-3425

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

The Meeting Center component in Cisco WebEx 11 generates different error messages for invalid file-access attempts depending on whether a file exists, which allows remote authenticated users to enumerate files via a series of SPI calls, aka Bug ID CSCuc35965.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Jul 31, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-34265.0The Serviceability servlet on Cisco 9900 IP phones does not properly restrict paths, which allows remote attackers to read arbitrary files b CVE-2013-34284.0The web interface in Cisco Secure Access Control System (ACS) does not properly suppress error-condition details, which allows remote authen CVE-2013-34297.8Multiple directory traversal vulnerabilities in Cisco Video Surveillance Manager (VSM) before 7.0.0 allow remote attackers to read system fi CVE-2013-34309.0Cisco Video Surveillance Manager (VSM) before 7.0.0 allows remote attackers to obtain sensitive configuration, archive, and log information CVE-2013-34317.8Cisco Video Surveillance Manager (VSM) before 7.0.0 does not require authentication for access to VSMC monitoring pages, which allows remote CVE-2013-34336.8Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privile CVE-2013-34346.8Untrusted search path vulnerability in Cisco Unified Communications Manager (CUCM) 7.1(x) through 9.1(1a) allows local users to gain privile CVE-2013-34355.0The Cisco Unified IP Conference Station 7937G allows remote attackers to cause a denial of service (networking outage) via a flood of TCP pa CVE-2013-34365.0The default configuration of the Group Encrypted Transport VPN (GET VPN) feature on Cisco IOS uses an improper mechanism for enabling Group CVE-2013-34376.5SQL injection vulnerability in the management application in Cisco Unified Operations Manager allows remote authenticated users to execute a CVE-2013-34385.0The web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to bypass intended access restriction CVE-2013-34394.3Cross-site scripting (XSS) vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML