PT-2019-3799 · Cisco · Cisco Expressway Series+1

Publicado 2019-10-16 · Atualizado 2019-10-22 · CVE-2019-12705

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) (affected versions not specified)

Description The issue is related to insufficient validation of user-supplied input by the web-based management interface, which could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. An attacker could exploit this by persuading a user to click a malicious link, potentially allowing the execution of arbitrary script code or access to sensitive browser-based information.

Recommendations For Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS), consider disabling the web-based management interface until a patch is available to prevent exploitation. Restrict access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface to click on links from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-04126

CVE-2019-12705

Produtos afetados

Cisco Expressway Series

Cisco Telepresence Video Communication Server

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-12705 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12705 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-vcs-xss · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04126 · Nota de Segurança