Executive Summary

Summary
Title Cisco Show and Share Security Vulnerabilities
Informations
Name cisco-sa-20111019-sns First vendor Publication N/A
Vendor Cisco Last vendor Modification 2011-10-19
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The Cisco Show and Share webcasting and video sharing application contains two vulnerabilities.

The first vulnerability allows an unauthenticated user to access several administrative web pages.

The second vulnerability permits an authenticated user to execute arbitrary code on the device under the privileges of the web server user account.

Cisco has released free software updates that address these vulnerabilities.

There are no workarounds available for these vulnerabilities.

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-264 Permissions, Privileges, and Access Controls
50 % CWE-94 Failure to Control Generation of Code ('Code Injection')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2

Open Source Vulnerability Database (OSVDB)

Id Description
76568 Cisco Show and Share Multiple Administrative Page Access Restriction Bypass
76567 Cisco Show and Share File Upload Arbitrary Code Execution