PT-2017-17319 · Cisco · Cisco Unified Communications Manager

Publicado 2017-08-17 · Atualizado 2017-08-24 · CVE-2017-6785

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 10.5(2.10000.5) through 11.5(1.10000.6)

Description A vulnerability in configuration modification permissions validation could allow an authenticated, remote attacker to perform a horizontal privilege escalation, modifying another user's configuration. This is due to a lack of proper Role Based Access Control (RBAC) when certain user configuration changes are requested. An attacker could exploit this by sending an authenticated, crafted HTTP request to the targeted application, impacting the integrity of the application.

Recommendations For versions 10.5(2.10000.5) through 11.5(1.10000.6), consider restricting access to user configuration modification features until a patch is available. As a temporary workaround, limit the privileges of users to prevent them from modifying other users' configurations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6785

Produtos afetados

Cisco Unified Communications Manager

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6785 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-ucm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6785 · Aviso do Fabricante
• http://securityfocus.com/bid/100375 · Nota
• http://securitytracker.com/id/1039184 · Nota