PT-2019-19454 · Audiocodes · Audiocodes Mediant

Published 2019-07-18 · Updated 2019-07-26 · CVE-2019-9231

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AudioCodes Mediant devices versions prior to 7.20A.202.307

Description A Cross-Site Request Forgery (CSRF) issue in the management web interface allows remote attackers to execute malicious and unauthorized actions. This is because CSRFProtection=1 is not a default setting and is not documented, leaving the interface vulnerable to such attacks.

Recommendations For versions prior to 7.20A.202.307, update the firmware to version 7.20A.202.307 or later to resolve the issue. As a temporary workaround, consider setting CSRFProtection=1 to enable CSRF protection, if possible, until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-9231

Affected Products

Audiocodes Mediant

References · 3

• https://osv.dev/vulnerability/CVE-2019-9231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9231 · Security Note
• https://cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf · Note