CVE-2014-8422

high

Description

The web-based management (WBM) interface in Unify (former Siemens) OpenStage SIP and OpenScape Desk Phone IP V3 devices before R3.32.0 generates session cookies with insufficient entropy, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

References

https://www.modzero.ch/advisories/MZ-14-02-Siemens-Unify-OpenStage.txt

https://networks.unify.com/security/advisories/OBSO-1501-02.pdf

Details

Source: Mitre, NVD

Published: 2018-04-12

Updated: 2021-09-09

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: High