PT-2021-5133 · Cisco · Cisco Unified Communications Manager+2
Abdelrhman Yousri
·
Published
2021-11-03
·
Updated
2021-11-06
·
CVE-2021-34773
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Unified Communications Manager (affected versions not specified)
Cisco Unified Communications Manager Session Management Edition (affected versions not specified)
Cisco Unified Communications Manager IM & Presence Service (affected versions not specified)
Description
A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this by persuading a user to click a malicious link, allowing the attacker to perform arbitrary actions with the targeted user's privilege level, including modifying device configuration and deleting user accounts.
Recommendations
For Cisco Unified Communications Manager, consider disabling access to the web-based management interface until a fix is available.
For Cisco Unified Communications Manager Session Management Edition, restrict access to the interface to minimize the risk of exploitation.
For Cisco Unified Communications Manager IM & Presence Service, avoid using the interface for critical operations until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Unified Communications Manager
Cisco Unified Communications Manager Im & Presence Service
Cisco Unified Communications Manager Session Management Edition