CVE Vulnerability

CVE-2019-1872

A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on network services in the affected software. An attacker could exploit this vulnerability by sending malicious requests to the affected system. A successful exploit could allow the attacker to send arbitrary network requests sourced from the affected system.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-vcs Vendor Advisory
http://www.securityfocus.com/bid/108677 Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:*
Information

Published : 2019-06-05 05:29

Updated : 2019-10-09 11:48

NVD link : CVE-2019-1872

Mitre link : CVE-2019-1872

Products Affected
No products.
CWE
CWE-918

Server-Side Request Forgery (SSRF)