CVE-2020-3360 : A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Ser

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending malicious requests to the device, which could allow the attacker to bypass access restrictions. A successful attack could allow the attacker to view sensitive information, including device call logs that contain names, usernames, and phone numbers of users of the device.

Published 2020-06-18 03:15:14

Updated 2021-08-06 18:45:50

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2020-3360

Cisco » Unified Ip Phone 6901 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_6901_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 6901 » Version: N/A
Cisco » Unified Ip Phone 6961 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_6961_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 6961 » Version: N/A
Cisco » Unified Ip Phone 6945 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_6945_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 6945 » Version: N/A
Cisco » Unified Ip Phone 6941 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_6941_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 6941 » Version: N/A
Cisco » Unified Ip Phone 6921 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_6921_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 6921 » Version: N/A
Cisco » Unified Ip Phone 6911 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_6911_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 6911 » Version: N/A
Cisco » Unified Ip Phone 7832 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7832_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7832 » Version: N/A
Cisco » Unified Ip Phone 7861 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7861_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7861 » Version: N/A
Cisco » Unified Ip Phone 7841 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7841_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7841 » Version: N/A
Cisco » Unified Ip Phone 7821 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7821_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7821 » Version: N/A
Cisco » Unified Ip Phone 7811 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7811_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7811 » Version: N/A
Cisco » Unified Ip Phone 7937g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7937g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7937g » Version: N/A
Cisco » Unified Ip Phone 7975g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7975g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7975g » Version: N/A
Cisco » Unified Ip Phone 7965g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7965g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7965g » Version: N/A
Cisco » Unified Ip Phone 7962g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7962g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7962g » Version: N/A
Cisco » Unified Ip Phone 7961g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7961g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7961g » Version: N/A
Cisco » Unified Ip Phone 7960g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7960g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7960g » Version: N/A
Cisco » Unified Ip Phone 7945g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7945g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7945g » Version: N/A
Cisco » Unified Ip Phone 7942g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7942g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7942g » Version: N/A
Cisco » Unified Ip Phone 7941g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7941g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7941g » Version: N/A
Cisco » Unified Ip Phone 7940g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7940g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7940g » Version: N/A
Cisco » Unified Ip Phone 7931g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7931g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7931g » Version: N/A
Cisco » Unified Ip Phone 7911g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7911g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7911g » Version: N/A
Cisco » Unified Ip Phone 7906g Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_7906g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 7906g » Version: N/A
Cisco » Unified Ip Phone 8811 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8811_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8811 » Version: N/A
Cisco » Unified Ip Phone 8841 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8841_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8841 » Version: N/A
Cisco » Unified Ip Phone 8845 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8845_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8845 » Version: N/A
Cisco » Unified Ip Phone 8851 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8851_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8851 » Version: N/A
Cisco » Unified Ip Phone 8851nr Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8851nr_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8851nr » Version: N/A
Cisco » Unified Ip Phone 8861 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8861_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8861 » Version: N/A
Cisco » Unified Ip Phone 8865 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8865_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8865 » Version: N/A
Cisco » Unified Ip Phone 8865nr Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8865nr_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8865nr » Version: N/A
Cisco » Unified Ip Phone 8961 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8961_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8961 » Version: N/A
Cisco » Unified Ip Phone 8945 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8945_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8945 » Version: N/A
Cisco » Unified Ip Phone 8941 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_8941_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 8941 » Version: N/A
Cisco » Unified Ip Phone 9971 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_9971_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 9971 » Version: N/A
Cisco » Unified Ip Phone 9951 Firmware
Versions up to, including, (<=) 12.8\(1\)
cpe:2.3:o:cisco:unified_ip_phone_9951_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Unified Ip Phone 9951 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-3360

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3360

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2020-3360

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: ykramarz@cisco.com (Secondary)
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-3360

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-phone-logs-2O7f7ExM

Cisco IP Phones Series 7800 and Series 8800 Call Log Information Disclosure Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-3360

Products affected by CVE-2020-3360

Exploit prediction scoring system (EPSS) score for CVE-2020-3360

CVSS scores for CVE-2020-3360

CWE ids for CVE-2020-3360

References for CVE-2020-3360