PT-2017-12404 · Cisco · Cisco Unified Customer Voice Portal

Publicado 2017-09-21 · Atualizado 2019-10-09 · CVE-2017-12214

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Customer Voice Portal (CVP) versions 10.5 through 11.5

Description A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality could allow an authenticated, remote attacker to gain elevated privileges due to a lack of proper input validation. The attacker must successfully authenticate to the system to exploit this issue. An attacker could exploit this by sending a crafted HTTP request to the OAMP after authentication. A successful exploit could allow the attacker to gain administrator privileges.

Recommendations For versions 10.5 through 11.5, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the OAMP credential reset functionality to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-264

Identificadores relacionados

CVE-2017-12214

Produtos afetados

Cisco Unified Customer Voice Portal

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-12214 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12214 · Aviso do Fabricante
• http://securitytracker.com/id/1039411 · Nota
• http://securityfocus.com/bid/100931 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cvp · Aviso do Fabricante