PT-2019-1380 · Cisco · Cisco Telepresence Management Suite

Publicado 2019-02-06 · Atualizado 2019-10-09 · CVE-2019-1660

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Management Suite (TMS) software (affected versions not specified)

Description A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The issue is due to a lack of proper access and authentication controls on the affected TMS software. An attacker could exploit this by sending crafted SOAP calls to the affected device, potentially allowing access to system management tools, which should normally be prohibited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-264

Identificadores relacionados

BDU:2019-00742

CVE-2019-1660

Produtos afetados

Cisco Telepresence Management Suite

Referências · 5

• https://bdu.fstec.ru/vul/2019-00742 · Nota de Segurança
• http://securityfocus.com/bid/106918 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-tms-soap · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1660 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1660 · Aviso do Fabricante