CVE-2018-0439: Cisco Meeting Server Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-0439?
CVE-2018-0439 is a vulnerability in the web-based management interface of Cisco Meeting Server that could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.
What is the severity of CVE-2018-0439?
The severity of CVE-2018-0439 is high with a CVSS score of 8.8.
Which versions of Cisco Meeting Server are affected by CVE-2018-0439?
Versions 2.0.0, 2.1.0, 2.2.0, 2.2.5, and 2.3.0 of Cisco Meeting Server are affected by CVE-2018-0439.
How can an attacker exploit CVE-2018-0439?
An attacker can exploit CVE-2018-0439 by performing a cross-site request forgery (CSRF) attack on the web-based management interface of Cisco Meeting Server.
Is there a fix available for CVE-2018-0439?
Yes, Cisco has released a security advisory with mitigations and software updates to address CVE-2018-0439. Please refer to the advisory for more information.