Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability
Published Oct 2, 2019
6.5
MEDIUMCVSS 3.1
EPSS 0.67%
Description
A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could change the password of a targeted user. An attacker could then take unauthorized actions on behalf of the targeted user.
Affected products
-
- Version unspecifiedStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Cisco | Cisco Unified Communications Manager | n/a |
|
Configuration 1
- 10.5\(2.10000.5\)
- 11.5\(1.10000.6\)
- 12.0\(1.10000.10\)
- 12.5\(1.10000.22\)
Configuration 2
- 11.5
- 12.0
- 12.5
- 14.0
Configuration 3
- 12.5\(1\)
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (1)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-csrf vendor-advisoryx_refsource_CISCOVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-csrf | vendor-advisoryx_refsource_CISCOVendor Advisory |
Change history (0)
No recorded changes yet.