OSVDB ID: 25165 Title: Cisco Unity Express Arbitrary User Expired Password Modification |
Info |
|
|
Dates |
||||
|
|
Description |
Cisco Unity Express contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the Unity Express HTTP interface allows any user to reset the password of any other user with an expired password. This flaw may lead to a loss of integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Authentication Management Impact: Loss of Integrity Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Upgrade to version 2.3.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|