PT-2017-17319 · Cisco · Cisco Unified Communications Manager

Published 2017-08-17 · Updated 2017-08-24 · CVE-2017-6785

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 10.5(2.10000.5) through 11.5(1.10000.6)

Description A vulnerability in configuration modification permissions validation could allow an authenticated, remote attacker to perform a horizontal privilege escalation, modifying another user's configuration. This is due to a lack of proper Role Based Access Control (RBAC) when certain user configuration changes are requested. An attacker could exploit this by sending an authenticated, crafted HTTP request to the targeted application, impacting the integrity of the application.

Recommendations For versions 10.5(2.10000.5) through 11.5(1.10000.6), consider restricting access to user configuration modification features until a patch is available. As a temporary workaround, limit the privileges of users to prevent them from modifying other users' configurations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6785

Affected Products

Cisco Unified Communications Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6785 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-ucm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6785 · Vendor Advisory
• http://securityfocus.com/bid/100375 · Note
• http://securitytracker.com/id/1039184 · Note