PT-2019-2357 · Cisco · Cisco Expressway Series+1

Published 2019-06-05 · Updated 2019-10-09 · CVE-2019-1872

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server and Cisco Expressway Series software (affected versions not specified)

Description The issue is related to improper restrictions on network services in the affected software, allowing an unauthenticated, remote attacker to cause the system to send arbitrary network requests. An attacker could exploit this by sending malicious requests, potentially allowing them to send arbitrary network requests sourced from the affected system. This could impact the integrity of protected information using specially crafted requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2019-02132

CVE-2019-1872

Affected Products

Cisco Expressway Series

Cisco Telepresence Video Communication Server

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-vcs · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02132 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1872 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1872 · Vendor Advisory
• http://securityfocus.com/bid/108677 · Note