Cloud Portal
CVE-2013-6708
MEDIUM
Severity by source
AV:N/AC:L/Au:N/C:P/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:N/AC:L/Au:N/C:P/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889.
AnalysisAI
Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-264. Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889. Affected products include: Cisco Cloud Portal.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Cloud Portal
View allDue to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces o
An attacker can upload an arbitrary file instead of a plant image. Rated critical severity (CVSS 9.3), this vulnerabilit
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while addin
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g.
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Rated medium
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. Rated medium severity (CVS
Unauthenticated attackers can rename "rooms" of arbitrary users. Rated medium severity (CVSS 6.9), this vulnerability is
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
An unauthenticated attacker can hijack other users' devices and potentially control them. Rated medium severity (CVSS 6.
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). Rated medium severity (CV
An unauthenticated attacker can obtain EV charger energy consumption information of other users. Rated medium severity (
An unauthenticated attacker can obtain other users' charger information. Rated medium severity (CVSS 6.9), this vulnerab
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today