PT-2019-2357 · Cisco · Cisco Expressway Series+1

Publicado 2019-06-05 · Atualizado 2019-10-09 · CVE-2019-1872

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server and Cisco Expressway Series software (affected versions not specified)

Description The issue is related to improper restrictions on network services in the affected software, allowing an unauthenticated, remote attacker to cause the system to send arbitrary network requests. An attacker could exploit this by sending malicious requests, potentially allowing them to send arbitrary network requests sourced from the affected system. This could impact the integrity of protected information using specially crafted requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2019-02132

CVE-2019-1872

Produtos afetados

Cisco Expressway Series

Cisco Telepresence Video Communication Server

Referências · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-vcs · Aviso do Fabricante
• http://securityfocus.com/bid/108677 · Nota
• https://bdu.fstec.ru/vul/2019-02132 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1872 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1872 · Aviso do Fabricante