description: A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.
problem types: Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Cisco
product: Cisco TelePresence Video Communication Server (VCS) Expressway
versions:
version: X8.5.1, status: affected
version: X8.5.3, status: affected
version: X8.5, status: affected
version: X8.6.1, status: affected
version: X8.6, status: affected
version: X8.1.1, status: affected
version: X8.1.2, status: affected
version: X8.1, status: affected
version: X8.2.1, status: affected
version: X8.2.2, status: affected
version: X8.2, status: affected
version: X8.7.1, status: affected
version: X8.7.2, status: affected
version: X8.7.3, status: affected
version: X8.7, status: affected
version: X8.8.1, status: affected
version: X8.8.2, status: affected
version: X8.8.3, status: affected
version: X8.8, status: affected
version: X8.9.1, status: affected
version: X8.9.2, status: affected
version: X8.9, status: affected
version: X8.10.0, status: affected
version: X8.10.1, status: affected
version: X8.10.2, status: affected
version: X8.10.3, status: affected
version: X8.10.4, status: affected
version: X12.5.8, status: affected
version: X12.5.9, status: affected
version: X12.5.0, status: affected
version: X12.5.2, status: affected
version: X12.5.7, status: affected
version: X12.5.3, status: affected
version: X12.5.4, status: affected
version: X12.5.5, status: affected
version: X12.5.1, status: affected
version: X12.5.6, status: affected
version: X12.6.0, status: affected
version: X12.6.1, status: affected
version: X12.6.2, status: affected
version: X12.6.3, status: affected
version: X12.6.4, status: affected
version: X12.7.0, status: affected
version: X12.7.1, status: affected
version: X8.11.1, status: affected
version: X8.11.2, status: affected
version: X8.11.4, status: affected
version: X8.11.3, status: affected
version: X8.11.0, status: affected
version: X14.0.1, status: affected
version: X14.0.3, status: affected
version: X14.0.2, status: affected
version: X14.0.4, status: affected
version: X14.0.5, status: affected
version: X14.0.6, status: affected
version: X14.0.7, status: affected
version: X14.0.8, status: affected
version: X14.0.9, status: affected
version: X14.0.10, status: affected
version: X14.0.11, status: affected
version: X14.2.1, status: affected
version: X14.2.2, status: affected
version: X14.2.5, status: affected
version: X14.2.6, status: affected
version: X14.2.0, status: affected
version: X14.2.7, status: affected
version: X14.3.0, status: affected
version: X14.3.1, status: affected
version: X14.3.2, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
baseScore: 8.2
baseSeverity: HIGH
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
]
exploits: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.