Vulnerabilities > CVE-2019-1872 - Server-Side Request Forgery (SSRF) vulnerability in Cisco Telepresence Video Communication Server
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on network services in the affected software. An attacker could exploit this vulnerability by sending malicious requests to the affected system. A successful exploit could allow the attacker to send arbitrary network requests sourced from the affected system.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
| NASL family | CISCO |
| NASL id | CISCO-SA-20190605-VCS.NASL |
| description | According to its self-reported version number, the version of Cisco TelePresence Video Communication Server is affected by an input- validation flaw that allows server-side request forgery (SSRF) leading to arbitrary network requests from the affected device. |
| last seen | 2020-03-17 |
| modified | 2020-03-05 |
| plugin id | 134227 |
| published | 2020-03-05 |
| reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/134227 |
| title | Cisco TelePresence Video Communication Server and Cisco Expressway Series Server-Side Request Forgery Vulnerability |