PT-2016-1194 · Cisco · Cisco Telepresence Video Communication Server

Publicado 2016-02-09 · Atualizado 2016-12-06 · CVE-2016-1316

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server (VCS) versions X8.1 through X8.7

Description The issue is related to the lack of protection for service data, allowing remote attackers to obtain sensitive call-statistics information via a direct request to an unspecified URL. This can be achieved by sending a specially crafted GET request.

Recommendations For versions X8.1 through X8.7, consider restricting access to the URL that provides call-statistics information until a patch is available. As a temporary workaround, limit the exposure of the Cisco TelePresence Video Communication Server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-00455

CVE-2016-1316

Produtos afetados

Cisco Telepresence Video Communication Server

Referências · 5

• http://securitytracker.com/id/1034956 · Nota
• https://osv.dev/vulnerability/CVE-2016-1316 · Aviso do Fabricante
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160208-vcs · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1316 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-00455 · Nota de Segurança