CVE-2013-1120

Published: Feb 6, 2013Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910.

Affected (15)

Products: Cisco: Unity Express Software, Unity Express

Cisco

2 products

Unity Express Software

Unity Express

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Cisco Unity Express Software	Up to 7.4
Cisco Unity Express Software	Version 1.1.1
Cisco Unity Express Software	Version 1.1.2
Cisco Unity Express Software	Version 2.0
Cisco Unity Express Software	Version 2.1
Cisco Unity Express Software	Version 2.2
Cisco Unity Express Software	Version 2.3
Cisco Unity Express Software	Version 3.0
Cisco Unity Express Software	Version 3.1
Cisco Unity Express Software	Version 3.2
Cisco Unity Express Software	Version 7.0
Cisco Unity Express Software	Version 7.1
Cisco Unity Express Software	Version 7.2
Cisco Unity Express Software	Version 7.3
Cisco Unity Express	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.