PT-2018-1774 · Cisco · Cisco Meeting Server

Published 2018-11-07 · Updated 2019-10-09 · CVE-2018-15446

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Meeting Server (affected versions not specified)

Description The issue is caused by errors in handling user requests. It may allow a remote attacker to gain access to sensitive information by sending specially crafted requests. The vulnerability is due to improper protections on data returned from user meeting requests when the Guest access via ID and passcode option is set to Legacy mode. An attacker could exploit this by sending meeting requests to an affected system, potentially determining the values of meeting room unique identifiers and allowing further exploits.

Recommendations For Cisco Meeting Server, consider changing the Guest access via ID and passcode option from Legacy mode to a more secure setting until a patch is available. As a temporary workaround, restrict access to meeting requests to minimize the risk of exploitation. Avoid using the Legacy mode for Guest access via ID and passcode until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2018-01374

CVE-2018-15446

Affected Products

Cisco Meeting Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15446 · Security Note
• https://bdu.fstec.ru/vul/2018-01374 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-meeting-server · Vendor Advisory
• http://securityfocus.com/bid/105856 · Note