CVE-2006-3290

HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL request.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml	Patch
http://www.securityfocus.com/bid/18701
http://securitytracker.com/id?1016398
http://secunia.com/advisories/20870
http://www.osvdb.org/26879
http://www.vupen.com/english/advisories/2006/2583
https://exchange.xforce.ibmcloud.com/vulnerabilities/27442

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:h:cisco:wireless_control_system:*:*:*:*:*:*:*:*

Information

Published : 2006-06-28 16:05

Updated : 2017-07-19 18:32

NVD link : CVE-2006-3290

Mitre link : CVE-2006-3290

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

cisco

wireless_control_system

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml", "name": "20060628 Multiple Vulnerabilities in Wireless Control System", "tags": ["Patch"], "refsource": "CISCO"}, {"url": "http://www.securityfocus.com/bid/18701", "name": "18701", "tags": [], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1016398", "name": "1016398", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/20870", "name": "20870", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/26879", "name": "26879", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2006/2583", "name": "ADV-2006-2583", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27442", "name": "cisco-wcs-http-information-disclosure(27442)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3290", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-06-28T23:05Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:cisco:wireless_control_system:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.2\\(51\\)"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-20T01:32Z"}