PT-2019-1382 · Cisco · Cisco Expressway Series+2

Published 2019-02-06 · Updated 2023-03-23 · CVE-2019-1679

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Conductor versions prior to XC4.3.4 Cisco Expressway Series versions prior to XC4.3.4 Cisco TelePresence Video Communication Server versions prior to XC4.3.4

Description The issue is related to insufficient access controls for the REST API, allowing an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host, which is known as server-side request forgery (SSRF). This can be exploited by submitting a crafted HTTP request to the affected server.

Recommendations For Cisco TelePresence Conductor versions prior to XC4.3.4, update to version XC4.3.4 or later. For Cisco Expressway Series versions prior to XC4.3.4, update to version XC4.3.4 or later. For Cisco TelePresence Video Communication Server versions prior to XC4.3.4, update to version XC4.3.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2019-00744

CVE-2019-1679

Affected Products

Cisco Expressway Series

Cisco Telepresence Conductor

Cisco Telepresence Video Communication Server

References · 5

• https://osv.dev/vulnerability/CVE-2019-1679 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00744 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-rest-api-ssrf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1679 · Security Note
• http://securityfocus.com/bid/106940 · Note