中文描述:

Cisco Spark Hybrid Calendar Service是美国思科（Cisco）公司的一款能够将本地协作服务连接到Cisco协作云的服务。 Cisco Spark Hybrid Calendar Service中的自动发现阶段存在信息泄露漏洞，该漏洞源于Hybrid Calendar服务实现的请求，程序会产生没有加密的HTTP请求。远程攻击者可通过监控网络上未加密的流量利用该漏洞访问Office365用户的数据（邮件和日历事件）。

英文描述:

A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive information in the unencrypted headers of an HTTP method request. The attacker could use this information to conduct additional reconnaissance attacks leading to the disclosure of sensitive customer data. The vulnerability exists in the auto discovery phase because an unencrypted HTTP request is made due to requirements for implementing the Hybrid Calendar service. An attacker could exploit this vulnerability by monitoring the unencrypted traffic on the network. An exploit could allow the attacker to access sensitive customer data belonging to Office365 users, such as email and calendar events. Cisco Bug IDs: CSCvg35593.

CWE类型:

标签:

中文解决方案:

英文解决方案:

临时解决方案: