PT-2019-3799 · Cisco · Cisco Expressway Series+1

Published 2019-10-16 · Updated 2019-10-22 · CVE-2019-12705

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) (affected versions not specified)

Description The issue is related to insufficient validation of user-supplied input by the web-based management interface, which could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. An attacker could exploit this by persuading a user to click a malicious link, potentially allowing the execution of arbitrary script code or access to sensitive browser-based information.

Recommendations For Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS), consider disabling the web-based management interface until a patch is available to prevent exploitation. Restrict access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface to click on links from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-04126

CVE-2019-12705

Affected Products

Cisco Expressway Series

Cisco Telepresence Video Communication Server

References · 4

• https://osv.dev/vulnerability/CVE-2019-12705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12705 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191016-vcs-xss · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04126 · Security Note