CVE-2014-8422

Опубликовано: 12 апр. 2018

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

Ссылки

https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
Mitigation
Vendor Advisory
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
Third Party Advisory
https://networks.unify.com/security/advisories/OBSO-1501-02.pdf
Mitigation
Vendor Advisory
https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:unify:openstage_sip:*:*:*:*:*:*:*:*

Версия до r3.32.0 (исключая)

Одно из

cpe:2.3:h:unify:openstage_20:-:*:*:*:*:*:*:*

cpe:2.3:h:unify:openstage_40:-:*:*:*:*:*:*:*

cpe:2.3:h:unify:openstage_60:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:unify:openscape_desk_phone_ip_sip:*:*:*:*:*:*:*:*

Версия до r3.32.0 (исключая)

Одно из

cpe:2.3:h:atos:openscape_desk_phone_ip_35g:-:*:*:*:*:*:*:*

cpe:2.3:h:atos:openscape_desk_phone_ip_35g_eco:-:*:*:*:*:*:*:*

cpe:2.3:h:atos:openscape_desk_phone_ip_55g:-:*:*:*:*:*:*:*

EPSS

Процентиль: 64%

0.00471

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-331

Связанные уязвимости

GHSA-prxv-hgr8-whhf