Cloud Portal
CVE-2014-3351
MEDIUM
Severity by source
AV:N/AC:L/Au:N/C:P/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:N/AC:L/Au:N/C:P/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, aka Bug IDs CSCuh87398 and CSCuh87380.
AnalysisAI
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, aka Bug IDs CSCuh87398 and CSCuh87380. Affected products include: Cisco Cloud Portal.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
More in Cloud Portal
View allDue to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces o
An attacker can upload an arbitrary file instead of a plant image. Rated critical severity (CVSS 9.3), this vulnerabilit
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while addin
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g.
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Rated medium
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. Rated medium severity (CVS
Unauthenticated attackers can rename "rooms" of arbitrary users. Rated medium severity (CVSS 6.9), this vulnerability is
Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
An unauthenticated attacker can hijack other users' devices and potentially control them. Rated medium severity (CVSS 6.
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). Rated medium severity (CV
An unauthenticated attacker can obtain EV charger energy consumption information of other users. Rated medium severity (
An unauthenticated attacker can obtain other users' charger information. Rated medium severity (CVSS 6.9), this vulnerab
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today