PT-2017-12404 · Cisco · Cisco Unified Customer Voice Portal

Published 2017-09-21 · Updated 2019-10-09 · CVE-2017-12214

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Customer Voice Portal (CVP) versions 10.5 through 11.5

Description A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality could allow an authenticated, remote attacker to gain elevated privileges due to a lack of proper input validation. The attacker must successfully authenticate to the system to exploit this issue. An attacker could exploit this by sending a crafted HTTP request to the OAMP after authentication. A successful exploit could allow the attacker to gain administrator privileges.

Recommendations For versions 10.5 through 11.5, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the OAMP credential reset functionality to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

CVE-2017-12214

Affected Products

Cisco Unified Customer Voice Portal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-12214 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12214 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cvp · Vendor Advisory
• http://securitytracker.com/id/1039411 · Note
• http://securityfocus.com/bid/100931 · Note