CVE-2017-12224

Severity Score

6.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the configuration setting Guest access via hyperlinks, which should allow the administrative user to prevent guest users from using hyperlinks to connect to meetings. An attacker could exploit this vulnerability by using a crafted hyperlink to connect to a meeting. An exploit could allow the attacker to connect directly to the meeting with a hyperlink, even though access should be denied. The attacker would still require a valid hyperlink and encoded secret identifier to be connected. Cisco Bug IDs: CSCve20873.

Una vulnerabilidad en la capacidad de los usuarios invitados de unirse a reuniones mediante un hipervínculo con Cisco Meeting Server podría permitir que un atacante remoto autenticado acceda a una reunión con una URL de hipervínculo, a pesar de que se le debería negar el acceso. Esta vulnerabilidad se debe a la incorrecta implementación de la opción de configuración de acceso de invitados mediante hipervínculos, lo que debería permitir que el usuario administrador evite que los usuarios invitados empleen hipervínculos para conectarse a las reuniones. Un atacante podría aprovechar esta vulnerabilidad empleando un hipervínculo manipulado para conectarse a una reunión. Si se explota esta vulnerabilidad, el atacante podría conectarse directamente a la reunión con un hipervínculo, aunque el acceso se le debería negar. Aun así, el atacante seguiría necesitando un hipervínculo válido y un identificador secreto codificado para conectarse. Cisco Bug IDs: CSCve20873.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-08-03 CVE Reserved
2017-09-07 CVE Published
2023-11-03 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/100657	Third Party Advisory
http://www.securitytracker.com/id/1039283	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cms	2019-10-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Meeting Server Search vendor "Cisco" for product "Meeting Server"				-		-		Affected