PT-2017-17327 · Cisco · Cisco Meeting Server

Publicado 2017-09-07 · Atualizado 2019-10-09 · CVE-2017-6794

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Meeting Server versions prior to and including 2.2

Description A vulnerability in the CLI command-parsing code could allow an authenticated, local attacker to perform command injection and escalate their privileges to root. The attacker must first authenticate to the application with valid administrator credentials. The issue is due to insufficient validation of user-supplied input at the CLI for certain commands. An attacker could exploit this by submitting a crafted CLI command for execution at the Cisco Meeting Server CLI, potentially allowing them to perform command injection and escalate their privilege level to root.

Recommendations For versions prior to and including 2.2, update to a version later than 2.2 to resolve the issue. As a temporary workaround, consider restricting access to the CLI and ensuring that only trusted administrators have access to the application.

Correção

Command Injection

RCE

Enumeração de Fraquezas

CWE-77

CWE-20

Identificadores relacionados

CVE-2017-6794

Produtos afetados

Cisco Meeting Server

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-6794 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6794 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170823-cms · Aviso do Fabricante
• http://securityfocus.com/bid/100464 · Nota
• http://securitytracker.com/id/1039245 · Nota