CVE-2013-3380 — MEDIUM (4.0)

Vulnerability Description

The administrative web interface in the Access Control Server in Cisco Secure Access Control System (ACS) does not properly restrict the report view page, which allows remote authenticated users to obtain sensitive information via a direct request, aka Bug ID CSCue79279.

CVSS Score

4.0

MEDIUM

AV:N/AC:L/Au:S/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Cisco	Secure Access Control Server Solution Engine	-

Related Weaknesses (CWE)

CWE-200

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3380Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3380Vendor Advisory

FAQ

What is CVE-2013-3380?

CVE-2013-3380 is a vulnerability with a CVSS score of 4.0 (MEDIUM). The administrative web interface in the Access Control Server in Cisco Secure Access Control System (ACS) does not properly restrict the report view page, which allows remote authenticated users to ob...

How severe is CVE-2013-3380?

CVE-2013-3380 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-3380?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Secure Access Control Server Solution Engine.