Auth bypass in Cisco Prime Central For Hosted Collaboration Solution Assurance

CVE-2013-3473

The web framework in Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance before 9.1.1 does not properly determine the existence of an authenticated session, which allows remote attackers to discover usernames and passwords via an HTTP request, aka Bug ID CSCud32600.

Vulnerability class: Broken Authentication

EPSS: 0.015 (72.1th percentile) — read the EPSS interpretation.

Affected products

Cisco Prime_central_for_hosted_collaboration_solution_assurance — versions 1.0, 1.0.1, 8.6
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)