CVE-2014-8422

EPSS 0.47%
Veröffentlicht 12.04.2018 21:29:00
Zuletzt bearbeitet 21.11.2024 02:19:03
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Unify ≫ Openstage Sip Version < r3.32.0

   Unify ≫ Openstage 20 Version-
   Unify ≫ Openstage 40 Version-
   Unify ≫ Openstage 60 Version-

Unify ≫ Openscape Desk Phone Ip Sip Version < r3.32.0

   Atos ≫ Openscape Desk Phone Ip 35g Version-
   Atos ≫ Openscape Desk Phone Ip 35g Eco Version-
   Atos ≫ Openscape Desk Phone Ip 55g Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.47%	0.638

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-331 Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

https://networks.unify.com/security/advisories/OBSO-1501-02.pdf

Vendor Advisory

Mitigation

https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2014-8422

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-8422

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-8422

EUVD