PT-2018-1774 · Cisco · Cisco Meeting Server

Publicado 2018-11-07 · Atualizado 2019-10-09 · CVE-2018-15446

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Meeting Server (affected versions not specified)

Description The issue is caused by errors in handling user requests. It may allow a remote attacker to gain access to sensitive information by sending specially crafted requests. The vulnerability is due to improper protections on data returned from user meeting requests when the Guest access via ID and passcode option is set to Legacy mode. An attacker could exploit this by sending meeting requests to an affected system, potentially determining the values of meeting room unique identifiers and allowing further exploits.

Recommendations For Cisco Meeting Server, consider changing the Guest access via ID and passcode option from Legacy mode to a more secure setting until a patch is available. As a temporary workaround, restrict access to meeting requests to minimize the risk of exploitation. Avoid using the Legacy mode for Guest access via ID and passcode until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2018-01374

CVE-2018-15446

Produtos afetados

Cisco Meeting Server

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15446 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-01374 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-meeting-server · Aviso do Fabricante
• http://securityfocus.com/bid/105856 · Nota