Vulnerabilities > CVE-2019-1872 - Server-Side Request Forgery (SSRF) vulnerability in Cisco Telepresence Video Communication Server

047910
CVSS 5.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
LOW
Availability impact
NONE
network
low complexity
cisco
CWE-918
nessus
NVD
Published: 2019-06-05
Updated: 2024-11-21

Summary

A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on network services in the affected software. An attacker could exploit this vulnerability by sending malicious requests to the affected system. A successful exploit could allow the attacker to send arbitrary network requests sourced from the affected system.

Vulnerable Configurations

Part Description Count
Application
Cisco
91

Common Weakness Enumeration (CWE)

Nessus

NASL familyCISCO
NASL idCISCO-SA-20190605-VCS.NASL
descriptionAccording to its self-reported version number, the version of Cisco TelePresence Video Communication Server is affected by an input- validation flaw that allows server-side request forgery (SSRF) leading to arbitrary network requests from the affected device.
last seen2020-03-17
modified2020-03-05
plugin id134227
published2020-03-05
reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/134227
titleCisco TelePresence Video Communication Server and Cisco Expressway Series Server-Side Request Forgery Vulnerability

References