// For flags

CVE-2019-1722

Cisco Expressway Series and Cisco TelePresence Video Communication Server Cross-Site Request Forgery Vulnerability

Severity Score

6.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. The arbitrary actions include adding an attacker-controlled device and redirecting calls intended for a specific user. For more information about CSRF attacks and potential mitigations, see Understanding Cross-Site Request Forgery Threat Vectors. This vulnerability is fixed in software version X12.5.1 and later.

Una vulnerabilidad en la función FindMe de Cisco Expressway Series y Cisco TelePresence Video Communication Server (VCS) podría permitir a un atacante remoto no identificado realizar un ataque de tipo cross-site request forgery (CSRF) y realizar acciones arbitrarias en un sistema afectado. La vulnerabilidad se debe a las insuficientes protecciones de CSRF para la interfaz de administración basada en web del sistema afectado. Un atacante podría aprovechar esta vulnerabilidad al persuadir a un usuario de la interfaz para que siga un enlace creado con fines maliciosos. Una operación con éxito podría permitir al atacante realizar acciones arbitrarias en un sistema afectado con los privilegios del usuario. Las acciones arbitrarias incluyen agregar un dispositivo controlado por un atacante y redirigir las llamadas destinadas a un usuario específico. Para obtener más información sobre los ataques CSRF y las posibles mitigaciones, consulte Cross-Site Request Forgery Threat Vectors. Esta vulnerabilidad se corrigió en la versión de software X12.5.1 y posterior.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-12-06 CVE Reserved
  • 2019-04-18 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Expressway Series
Search vendor "Cisco" for product "Expressway Series"
--
Affected
Cisco
Search vendor "Cisco"
 Telepresence Video Communication Server
Search vendor "Cisco" for product "Telepresence Video Communication Server"
 < x12.5.1
Search vendor "Cisco" for product "Telepresence Video Communication Server" and version " < x12.5.1"
-
Affected