PT-2018-8709 · Cisco · Cisco Meeting Server

Published 2018-06-07 · Updated 2020-09-04 · CVE-2018-0263

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Meeting Server (CMS) versions prior to 2.2.13 Cisco Meeting Server (CMS) versions prior to 2.3.4

Description: A vulnerability in Cisco Meeting Server could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an affected system. This is due to incorrect default configuration, exposing internal interfaces and ports on the external interface. A successful exploit could allow the attacker to gain unauthenticated access to configuration and database files and sensitive meeting information.

Recommendations: For versions prior to 2.2.13, update to Release 2.2.13 or later. For versions prior to 2.3.4, update to Release 2.3.4 or later.

Fix

Weakness Enumeration

CWE-16

CWE-1188

Related Identifiers

CVE-2018-0263

Affected Products

Cisco Meeting Server

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cms-id · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0263 · Security Note
• http://securityfocus.com/bid/104419 · Note
• http://securitytracker.com/id/1041065 · Note