PT-2023-8660 · Cisco · Cisco Meeting Server

Published 2023-11-01 · Updated 2024-01-25 · CVE-2023-20255

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Meeting Server (affected versions not specified)

Description The issue is related to insufficient validation of HTTP requests in the Web Bridge feature of Cisco Meeting Server, which could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This could lead to a partial availability condition, causing ongoing video calls to be dropped due to invalid packets reaching the Web Bridge. An attacker could exploit this by sending crafted HTTP packets to an affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-01405

CVE-2023-20255

Affected Products

Cisco Meeting Server

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cms-segfault-G6ES4Ve8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20255 · Security Note
• https://bdu.fstec.ru/vul/2024-01405 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20255 · Vendor Advisory
• https://twitter.com/CVEnew/status/1719768444621422698 · Twitter Post
• https://twitter.com/brierandthorn/status/1720184015414526451 · Twitter Post