CVE-2020-3360
published 2020-06-18CVE-2020-3360: A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.26%
66.4th percentile
A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ip_phone_8800_series_software | — | — |
| cisco | ip_phones_call_log | — | — |
| cisco | unified_ip_phone_6901_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_6911_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_6921_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_6941_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_6945_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_6961_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7811_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7821_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7832_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7841_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7861_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7906g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7911g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7931g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7937g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7940g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7941g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7942g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7945g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7960g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7961g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7962g_firmware | <= 12.8\(1\) | — |
| cisco | unified_ip_phone_7965g_firmware | <= 12.8\(1\) | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j6rq-w94j-r7m5: A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensi
ghsa_unreviewed·2022-05-24
CVE-2020-3360 [MEDIUM] CWE-863 GHSA-j6rq-w94j-r7m5: A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensi
A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device.
Cisco
Cisco IP Phones Call Log Information Disclosure Vulnerability
vendor_cisco·2020-06-17·CVSS 5.3
CVE-2020-3360 [MEDIUM] CWE-200 Cisco IP Phones Call Log Information Disclosure Vulnerability
Cisco IP Phones Call Log Information Disclosure Vulnerability
A vulnerability in the Web Access feature of Cisco IP Phones could allow an unauthenticated, remote attacker to view sensitive information on an affected device.
The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.ci
Cisco
Cisco IP Phones Call Log Information Disclosure Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3360 Cisco IP Phones Call Log Information Disclosure Vulnerability
CVE-2020-3360: Cisco IP Phones Call Log Information Disclosure Vulnerability
A vulnerability in the Web Access feature of Cisco IP Phones could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device. There are no
CVSS: 3.0
CWE: CWE-200, CWE-200
Bug IDs: CSCvt23310, CSCvt27636, CSCvt27637, CSCvt23310, CSCvt27636
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-06-18
Published