Details of VAR-201002-0211

ID

VAR-201002-0211

CVE

CVE-2010-0642

TITLE

CCS In JHTML Vulnerability to read file source code

Trust: 0.8

sources: JVNDB: JVNDB-2010-003848

DESCRIPTION

Cisco Collaboration Server (CCS) 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by (1) changing .jhtml to %2Ejhtml, (2) changing .jhtml to .jhtm%6C, (3) appending %00 after .jhtml, and (4) appending %c0%80 after .jhtml, related to the (a) doc/docindex.jhtml, (b) browserId/wizardForm.jhtml, (c) webline/html/forms/callback.jhtml, (d) webline/html/forms/callbackICM.jhtml, (e) webline/html/agent/AgentFrame.jhtml, (f) webline/html/agent/default/badlogin.jhtml, (g) callme/callForm.jhtml, (h) webline/html/multichatui/nowDefunctWindow.jhtml, (i) browserId/wizard.jhtml, (j) admin/CiscoAdmin.jhtml, (k) msccallme/mscCallForm.jhtml, and (l) webline/html/admin/wcs/LoginPage.jhtml components. Cisco Collaboration Server (CCS) Is flawed in the processing related to the following components, JHTML A vulnerability exists that allows the source code of a file to be read. Cisco Collaboration Server is prone to multiple vulnerabilities that may allow remote attackers to obtain sourcecode, which may aid them in further attacks. Cisco Collaboration Server 5 is vulnerable; other versions may be affected as well. NOTE: The vendor has discontinued this product. A remote attacker can read the source code of JHTML script files by adding encoded URLs to the file name extensions of multiple scripts

Trust: 1.98

sources: NVD: CVE-2010-0642 // JVNDB: JVNDB-2010-003848 // BID: 38202 // VULHUB: VHN-43247

AFFECTED PRODUCTS

vendor:

cisco

model:

collaboration server

scope:

version:

5.0

Trust: 2.7

sources: BID: 38202 // JVNDB: JVNDB-2010-003848 // CNNVD: CNNVD-201002-163 // NVD: CVE-2010-0642

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2010-0642
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2010-0642
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201002-163
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-43247
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2010-0642
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-43247
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-43247 // JVNDB: JVNDB-2010-003848 // CNNVD: CNNVD-201002-163 // NVD: CVE-2010-0642

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-43247 // JVNDB: JVNDB-2010-003848 // NVD: CVE-2010-0642

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201002-163

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201002-163

CONFIGURATIONS

sources: JVNDB: JVNDB-2010-003848

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-43247

PATCH

title:

Top Page

url:

http://www.cisco.com/en/US/products/sw/custcosw/ps747/prod_eol_notice09186a008032d4d0.html

Trust: 0.8

sources: JVNDB: JVNDB-2010-003848

EXTERNAL IDS

db:	NVD	id:	CVE-2010-0642	Trust: 2.8
db:	BID	id:	38202	Trust: 2.0
db:	EXPLOIT-DB	id:	11403	Trust: 1.7
db:	JVNDB	id:	JVNDB-2010-003848	Trust: 0.8
db:	CNNVD	id:	CNNVD-201002-163	Trust: 0.7
db:	XF	id:	56221	Trust: 0.6
db:	VULHUB	id:	VHN-43247	Trust: 0.1

sources: VULHUB: VHN-43247 // BID: 38202 // JVNDB: JVNDB-2010-003848 // CNNVD: CNNVD-201002-163 // NVD: CVE-2010-0642

REFERENCES

url:	http://www.securityfocus.com/bid/38202	Trust: 1.7
url:	http://www.exploit-db.com/exploits/11403	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/56221	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0642	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0642	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/56221	Trust: 0.6
url:	http://www.cisco.com/en/us/products/sw/custcosw/ps747/prod_eol_notice09186a008032d4d0.html	Trust: 0.3

sources: VULHUB: VHN-43247 // BID: 38202 // JVNDB: JVNDB-2010-003848 // CNNVD: CNNVD-201002-163 // NVD: CVE-2010-0642

CREDITS

s4squatch

Trust: 0.9

sources: BID: 38202 // CNNVD: CNNVD-201002-163

SOURCES

db:	VULHUB	id:	VHN-43247
db:	BID	id:	38202
db:	JVNDB	id:	JVNDB-2010-003848
db:	CNNVD	id:	CNNVD-201002-163
db:	NVD	id:	CVE-2010-0642

LAST UPDATE DATE

2025-04-11T23:13:08.970000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-43247	date:	2017-08-17T00:00:00
db:	BID	id:	38202	date:	2015-04-13T21:02:00
db:	JVNDB	id:	JVNDB-2010-003848	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-201002-163	date:	2010-02-18T00:00:00
db:	NVD	id:	CVE-2010-0642	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-43247	date:	2010-02-17T00:00:00
db:	BID	id:	38202	date:	2010-02-11T00:00:00
db:	JVNDB	id:	JVNDB-2010-003848	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-201002-163	date:	2010-02-17T00:00:00
db:	NVD	id:	CVE-2010-0642	date:	2010-02-17T18:30:00.570