PT-2019-19454 · Audiocodes · Audiocodes Mediant

Publicado 2019-07-18 · Atualizado 2019-07-26 · CVE-2019-9231

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AudioCodes Mediant devices versions prior to 7.20A.202.307

Description A Cross-Site Request Forgery (CSRF) issue in the management web interface allows remote attackers to execute malicious and unauthorized actions. This is because CSRFProtection=1 is not a default setting and is not documented, leaving the interface vulnerable to such attacks.

Recommendations For versions prior to 7.20A.202.307, update the firmware to version 7.20A.202.307 or later to resolve the issue. As a temporary workaround, consider setting CSRFProtection=1 to enable CSRF protection, if possible, until a patch is applied.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-9231

Produtos afetados

Audiocodes Mediant

Referências · 3

• https://cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf · Nota
• https://osv.dev/vulnerability/CVE-2019-9231 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9231 · Nota de Segurança