« Volver al listado

CVE-2013-3384

Estado: ModificadaAlta (9)—

The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.2.2-110, 7.7 before 7.7.0-213, and 7.8 and 7.9 before 7.9.1-102 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL, aka Bug IDs CSCzv85726, CSCzv44633, and CSCzv24579.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Ironport Asyncos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-3384",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-06-27T21:55:07.023",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-sma",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-esa",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-sma",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130626-wsa",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.2.2-110, 7.7 before 7.7.0-213, and 7.8 and 7.9 before 7.9.1-102 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL, aka Bug IDs CSCzv85726, CSCzv44633, and CSCzv24579."
    },
    {
      "lang": "es",
      "value": "El framework web de IronPort AsyncOS en dispositivos Cisco Web Security Appliance antes v7.1.3-013, v7.5 antes de v7.5.0-838, y v7.7 antes de v7.7.0-550, dispositivos Email Security Appliance antes de v7.1.5-104, v7.3 antes de v7.3.2-026, v7.5 antes v7.5.2-203 y v7.6 antes v7.6.3-019, y dispositivos Content Security Management Appliance antes de v7.2.2-110, v7.7 antes de v7.7.0-213 y v7.8 y v7.9 antes de 7.9.1-102 permite a los usuarios remotos autenticados ejecutar código arbitrario a través de entrada de línea de comandos diseñado en una URL, también conocido como Bug ID CSCzv85726, CSCzv44633 y CSCzv24579."
    }
  ],
  "lastModified": "2026-06-16T23:55:00.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFD8A32D-FEF9-45E5-8585-B9745387B28F",
              "versionEndIncluding": "7.1.3"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3AEF753-45FF-4681-8FEE-ECFAC075B60C"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5C0DD8C-4865-46F9-AA25-A468F9DB35F9"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:7.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8B29C05-CC5F-429F-A77B-73C5D6052C12"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F82B4FD-20BF-49A7-B0EA-8109B0BEA848"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:7.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8784ABD6-7084-4085-ADCE-4FC1BCEBE0FD"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:7.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "308D3736-3EFD-4183-A852-58ABDBF35B13"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:7.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DFFBC92-3D52-4FA6-AB46-A774B9A9C6DB"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:content_security_management:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1F1C1929-DBDA-42CE-A497-CAE0540F2174"
            },
            {
              "criteria": "cpe:2.3:h:cisco:web_security_appliance:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8F24CCD0-DFAB-44D9-B29A-A6D925A83C93"
            },
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5BA3A518-E103-4D98-A040-88ED4E0D73CC"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}