Password Field AutoComplete Vulnerability in CUCM V10.5.2

[pradeep.ts]

Hi,

Can anyone help me to find the solution for the below Password Field AutoComplete Vulnerability in CUCM V10.5.2

Vulunerability detyails as below

Password input fields on this page allow auto-completion.  Users can easily gain unauthorized access to protected information.

Thanks in advance

Pradeep

[Wilson Samuel]

Hi Pradeep,

Could you please re-post the link as I couldnt reach the URL you had posted.

Regards

[pradeep.ts]

Hi Wilson,

Thank you for the post, please find the below vulnerability details encountered during the security scan.

Affected Products

CUCM/ CUC - 10.5.2

Vulnerability details

 Password input fields on this page allow auto-completion.  Users can easily gain unauthorized access to protected information.

To do

 Forms where passwords are submitted should only be enabled over HTTPS, password fields should also contain the option 'autocomplete=off'  MITIGATION Vulnerable pages can be deleted or blocked, although this will affect website functionality.

Thanks in advance

Pradeep.

[Jaime Valencia]

You have no control over the webpages from CUC/CUC, I'm assuming this is the outcome from a tool you ran, and not something we deemed as a vulnerability, right???

[pradeep.ts]

Yes, you are right Jaime,

This is result is form the security scanning tool, unfortunately this is classified as vulnerability.

Is there any way to restrict this from CUCM/CUC services ?

With Thanks & Regards,

Pradeep.

[Jaime Valencia]

As I already mentioned, you have no control over the pages. You'll have to explain this cannot be adjusted, you'll have to do something in the user side to disable them storing passwords.

[pradeep.ts]

Thanks Jaime

[Wilson Samuel]

Hi,

I thought it was a vulnerability as published by Cisco. If it is not a vulnerability published by Cisco and some third party (in your case it is for the browser).

I recommend always keeping a patched up for any Security Patches and always use Firefox (and to some extent Chrome)

HTH

[pradeep.ts]

Thanks Wilson