cisco-sa-20190206-rest-api-ssrf: Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server REST API Server-Side Request Forgery Vulnerability
First published: Wed Feb 06 2019(Updated: )
A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack is commonly referred to as server-side request forgery (SSRF). The vulnerability is due to insufficient access controls for the REST API of Cisco Expressway Series and Cisco TelePresence VCS. An attacker could exploit this vulnerability by submitting a crafted HTTP request to the affected server. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-rest-api-ssrf
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco TelePresence Conductor Firmware | ||
| Cisco Expressway | ||
| Cisco TelePresence Video Communication Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20190206-rest-api-ssrf?
The severity of cisco-sa-20190206-rest-api-ssrf is considered high due to the potential for remote exploitation.
How do I fix cisco-sa-20190206-rest-api-ssrf?
To fix cisco-sa-20190206-rest-api-ssrf, apply the latest firmware updates provided by Cisco for affected products.
What products are affected by cisco-sa-20190206-rest-api-ssrf?
The affected products for cisco-sa-20190206-rest-api-ssrf include Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server.
Who can exploit the cisco-sa-20190206-rest-api-ssrf vulnerability?
The cisco-sa-20190206-rest-api-ssrf vulnerability can be exploited by authenticated remote attackers.
What does cisco-sa-20190206-rest-api-ssrf allow attackers to do?
The cisco-sa-20190206-rest-api-ssrf vulnerability allows attackers to trigger HTTP requests from the affected server to arbitrary hosts.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/references
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco telepresence conductor firmware
- canonical/cisco expressway
- canonical/cisco telepresence video communication server