PT-2019-3792 · Cisco · Cisco Unified Communications Manager Im/Presence (Unified Cm Im&P) Service+3

Published 2019-10-02 · Updated 2023-02-16 · CVE-2019-1915

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager (affected versions not specified) Cisco Unified Communications Manager Session Management Edition (SME) (affected versions not specified) Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service (affected versions not specified) Cisco Unity Connection (affected versions not specified)

Description The issue is related to a lack of protection against cross-site request forgery (CSRF) attacks in the web-based interface of the affected systems. An attacker could exploit this by persuading a targeted user to click a malicious link, allowing the attacker to send arbitrary requests. This could potentially change the password of a targeted user, enabling the attacker to take unauthorized actions on behalf of the targeted user.

Recommendations For Cisco Unified Communications Manager, consider disabling access to the web-based interface until a patch is available. For Cisco Unified Communications Manager Session Management Edition (SME), restrict access to the vulnerable web-based interface to minimize the risk of exploitation. For Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, avoid using the web-based interface for sensitive operations until the issue is resolved. For Cisco Unity Connection, as a temporary workaround, consider limiting user access to the web-based interface until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2019-04117

CVE-2019-1915

Affected Products

Cisco Unified Communications Manager

Cisco Unified Communications Manager Im/Presence (Unified Cm Im&P) Service

Cisco Unified Communications Manager Session Management Edition

Cisco Unity Connection

References · 4

• https://osv.dev/vulnerability/CVE-2019-1915 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-csrf · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04117 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1915 · Security Note