PT-2020-1578 · Cisco · Cisco Unified Customer Voice Portal

Published 2020-01-08 · Updated 2020-10-05 · CVE-2019-16017

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Customer Voice Portal (affected versions not specified)

Description The issue is related to insufficient input validation on specific pages of the OAMP application, allowing an authenticated, remote attacker to execute Insecure Direct Object Reference actions. This could enable an attacker with administrator or read-only privileges to access information outside their expected scope. An attacker with administrator privileges could also modify configuration details, potentially resulting in a denial of service condition. The vulnerability can be exploited by sending crafted HTTP requests after authenticating to Cisco Unified CVP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

BDU:2020-00619

CVE-2019-16017

Affected Products

Cisco Unified Customer Voice Portal

References · 5

• https://osv.dev/vulnerability/CVE-2019-16017 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-cvp-direct-obj-ref · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16017 · Security Note
• https://bdu.fstec.ru/vul/2020-00619 · Security Note
• https://t.me/cibsecurity/14830 · Telegram Post