CVE-2019-1877: Cisco Enterprise Chat and Email Attachment Download Vulnerability
First published: Tue Nov 05 2019(Updated: )
A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to download files that other users attach through the chat feature. This vulnerability affects versions prior to 12.0(1)ES1.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Enterprise Chat and Email | =11.6\(1\)es9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1877?
CVE-2019-1877 is a vulnerability in the HTTP API of Cisco Enterprise Chat and Email that could allow an unauthenticated, remote attacker to download files attached through chat sessions.
How can an attacker exploit CVE-2019-1877?
An attacker can exploit CVE-2019-1877 by taking advantage of insufficient authentication mechanisms on the file download function of the API, allowing them to download attached files.
What is the severity of CVE-2019-1877?
CVE-2019-1877 has a severity value of 6.5, which is considered medium.
Which software is affected by CVE-2019-1877?
The vulnerability affects Cisco Enterprise Chat and Email version 11.6(1)es9.
How do I fix CVE-2019-1877?
To fix CVE-2019-1877, Cisco has released a security advisory with recommended updates and patches. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/author
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/cisco
- canonical/cisco enterprise chat and email
- version/cisco enterprise chat and email/11.6\(1\)es9